Examkin

Question

Difficulty: EasyApplication and Software Vulnerabilities

A security analyst is reviewing a vulnerability scan report for a company web application. The report indicates that an attacker can access arbitrary files on the server's file system by inserting relative path sequences (such as `../../etc/passwd`) into a file request parameter. Which of the following application vulnerabilities is described in this scenario?

  1. Directory traversalAnswer
  2. B
    Cross-site scripting (XSS)
  3. C
    Improper authentication
  4. D
    Network firewall misconfiguration

Answer

Directory traversal
The correct answer is directory traversal because the inclusion of dot-dot-slash (`../`) sequences in input fields specifically aims to bypass access controls and navigate out of the web server root directory to read arbitrary files from the operating system.

Step-by-Step Solution

1
Analyze the attack payload described in the scenario
The input uses directory navigation symbols (`../../`) to traverse system directories
Sequences like `../` move up one level in the file system directory structure
2
Map the vulnerability mechanism to standard security taxonomy
The flaw allows accessing files outside the web root directory (path traversal)
Insufficient input validation combined with unsafe file path construction results in directory traversal

Key Concept

Directory Traversal / Path Traversal Vulnerability
Estimated Time:45s
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic