File Path Manipulation

Explore Pynt's documentation on file path manipulation security tests! Understand how Pynt safeguards against file path vulnerabilities, ensuring robust security for your APIs.

Intro

File path manipulation (sometimes called LFI - local file inclusion) is a type of security vulnerability that occurs when a cloud application allows an attacker to include files located on the server's local file system. This vulnerability typically arises when the application processes user-supplied input without proper validation or sanitization.

This vulnerability can have serious consequences as it allows an attacker to read sensitive files on the server. Some of the files that may be accessible through this vulnerability include configuration files, sensitive user data, and even system files, depending on the application's configuration and permissions.

What are the common mistakes done by developers ?

1. Insufficient input validation: Failing to properly validate user-supplied input allows attackers to manipulate file paths and inject malicious data that leads to file path attacks.

2. Using user-controlled input directly: Including user-controlled input, such as file names or paths, directly in file inclusion functions without proper sanitization can enable attacks.

3. Not using absolute file paths: Relying on relative file paths in file inclusion functions can create vulnerabilities, as attackers may manipulate the relative paths to access unauthorized files.

4. Allowing directory traversal: Failing to restrict access to specific directories can enable attackers to traverse the directory structure and access sensitive files outside the intended scope.

How can I fix file path manipulation issues ?

1. Input Validation and Sanitization:

   • Always validate and sanitize user input before using it in file inclusion functions. Use whitelisting or regular expressions to ensure that input adheres to expected patterns.

   • Avoid using user-controlled input directly in file paths without proper validation.

2. Use Absolute File Paths:

   • Instead of relying on relative file paths, use absolute file paths when including files. This ensures that files are loaded from specific, predefined locations and prevents directory traversal attacks.

3. Implement Access Controls:

   • Enforce access controls to restrict access to sensitive files and directories. Only allow access to files that are essential for the application's functionality and deny access to others.

4. Disable Remote File Inclusion:

   • If your application doesn't require it, disable the option to include files from remote servers. Remote file inclusion can be a security risk and should be avoided if not necessary.

5. Secure File Inclusion Functions:

   • If possible, use safer alternatives to file inclusion functions that provide additional security features. For example, some programming languages offer functions that automatically handle input sanitization and file inclusion securely.

Test cases in this category:

This test case queries excessive number of elements

Test case	OWASP	CWE
[FM001] File path manipulation