CWE-32 is path traversal through the "..." sequence. The product builds a path from external input and does not neutralize triple dots, so the path can resolve outside the directory it was supposed to stay within.
It sounds odd until you read what MITRE says. On some Windows systems, "..." is equivalent to "....", and it can slip past checks that assume only two dots are valid.
How it happens
Two things combine here. One is the platform quirk: some systems interpret a run of dots as several parent directory hops. The other is a filter written for the textbook case, where only ".." counts.
The filter inspects the input, sees no ".." that it recognizes as a pair standing alone, and lets it through. The file system then does something the author never pictured.
MITRE adds a related point. Incomplete filtering, such as removing "./" sequences, can produce valid ".." sequences after the removal, because the text collapses into an unsafe value, tracked as CWE-182. So even a filter that handles dots can create the weakness by cleaning up.
What an attacker gains
The record lists reading files or directories and modifying files or directories. MITRE's observed cases are old and mostly in network services:
- CVE-2001-0467: "..." in a web server.
- CVE-2001-0615: "..." or "...." in a chat server.
- CVE-2001-0963: "..." in the cd command of an FTP server.
- CVE-2001-1193: "..." in the cd command of an FTP server.
The spread across web, chat and FTP software says something. Any program that accepts a path from a user and passes it to a Windows file API can carry this flaw.
How to find it
Automated static analysis can find file operations that take external input. In testing, add dot variants to your traversal list: three dots, four dots, and mixes with separators. A suite that only tries ".." has a blind spot.
How to fix it
Do not try to list every strange dot pattern. Ask the platform where the path really points.
import os
BASE = os.path.realpath("C:/srv/files")
def resolve(user_path):
full = os.path.realpath(os.path.join(BASE, user_path))
if os.path.commonpath([BASE, full]) != BASE:
raise ValueError("outside base directory")
return full
Then add the usual layers:
- Reject input with unexpected characters. If you expect a file name, allow letters, digits, a dot and a hyphen, and nothing else.
- Use IDs mapped on the server in place of client supplied names.
- Run the process with minimal file access.
- Keep the underlying server software patched.
Quick check
Why can '...' work as a parent directory?
MITRE notes that on some Windows systems it is equivalent to "....". A filter that only recognizes two dots does not catch it.
