From ef9c11c95fa4fc8a64cf6e54956c9d4631b82ef6 Mon Sep 17 00:00:00 2001 From: Justin Collins Date: Thu, 25 Jan 2024 17:10:36 -0800 Subject: [PATCH] Site updated at Thu Jan 25 05:10:36 PM PST 2024 --- docs/warning_types/index.html | 1 + docs/warning_types/path_traversal/index.html | 194 +++++++++++++++++++ feed.xml | 2 +- 3 files changed, 196 insertions(+), 1 deletion(-) create mode 100644 docs/warning_types/path_traversal/index.html diff --git a/docs/warning_types/index.html b/docs/warning_types/index.html index 754ec3ac1..9afb6774c 100644 --- a/docs/warning_types/index.html +++ b/docs/warning_types/index.html @@ -100,6 +100,7 @@

Warning Types

  • Information Disclosure
  • Mail Link
  • Mass Assignment
    • +
  • Path Traversal
  • Remote Code Execution
  • Remote Execution in YAML.load
  • Session Manipulation
    • diff --git a/docs/warning_types/path_traversal/index.html b/docs/warning_types/path_traversal/index.html new file mode 100644 index 000000000..49b148281 --- /dev/null +++ b/docs/warning_types/path_traversal/index.html @@ -0,0 +1,194 @@ + + + + + + + + Brakeman: Path Traversal + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +

    Brakeman

    + +

    Ruby on Rails Static Analysis Security Tool

    + +
    + +
    + +
    +
    +
    +
    + +
    +

    Path Traversal

    +
    + +

    Path traversal vulnerabilities allow an attacker to access or manipulate files outside the intended +directory by providing specially crafted paths as input to read or write sensitive data. This can occur when +improperly handling user-supplied input in filesystem-related operations such as image uploads, dynamic content loading, and user file downloads.

    + +

    An attacker could exploit a path traversal vulnerability to:

    + +
      +
    • Read sensitive files, including configuration files or other data containing credentials or encryption keys.
      • +
    • Write files into restricted directories that enables code injection or privilege escalation.
      • +
    • Download or delete critical system files.
      • +
    • Gain access to user data and perform unauthorized actions.
      • +
    + +

    Example

    + +
    # `params[:file][:path]` could contain "../../../../../etc/passwd", e.g.
+
+send_file File.join('some', 'path', params[:file][:path])
+
    + +

    Pathname Confusion

    + +

    Pathname#join has some confusing behavior: any absolute path segment (e.g. starting with /) causes the path to be absolute from that point.

    + +

    Example:

    + +
    > Pathname.new('a').join("a", "b", "/c", "d")
+ => #<Pathname:/c/d> 
+
    + +

    Note that Rails.root is a Pathname.

    + +

    Exercise extreme caution when passing user-provided input to this function.

    + +
    +

    Back to Warning Types

    + + +
    +

    + + +

    +
    + +
    + +
    + + + + +
    +
    + + + diff --git a/feed.xml b/feed.xml index 919e3630b..8b213a972 100644 --- a/feed.xml +++ b/feed.xml @@ -1,4 +1,4 @@ -Jekyll2024-01-03T16:50:39-08:00https://brakemanscanner.org/feed.xmlBrakemanBrakeman 6.1.0 Released2023-12-04T22:30:00-08:002023-12-04T22:30:00-08:00https://brakemanscanner.org/blog/2023/12/04/brakeman-6-dot-1-dot-0-released<p>It’s been a while!</p> +Jekyll2024-01-25T17:10:18-08:00https://brakemanscanner.org/feed.xmlBrakemanBrakeman 6.1.0 Released2023-12-04T22:30:00-08:002023-12-04T22:30:00-08:00https://brakemanscanner.org/blog/2023/12/04/brakeman-6-dot-1-dot-0-released<p>It’s been a while!</p> <p><em>Changes since 6.0.1:</em></p>