Security Test: Directory traversal¶

Description¶

Default Severity: high

Directory traversal allows an attacker to manipulate file paths so that they’re able to access files outside the intended directory. It happens when a web application doesn’t properly check or sanitize file path inputs, which means an attacker can trick it into revealing sensitive files like configuration or system information. This is dangerous because it can expose details that could be used to further penetrate the system or compromise data. Developers often make the mistake of assuming input is safe, which is why it's important to validate and restrict what file paths can be accessed.

Reference:

• https://escape.tech/blog/file-inclusion-directory-traversal-graphql/

Configuration¶

Identifier: injection/directory_traversal

Examples¶

All configuration available:

checks:
  injection/directory_traversal:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶