Path Manipulation (security vulnerability)

c# .net security path-manipulation
Induster picture Induster · Apr 10, 2012 · Viewed 10.1k times · Source

A Fortify security review informed us of some path manipulation vulnerabilities. Most have been obvious and easy fixes, but I don't understand how to fix the following one.

string[] wsdlFiles = System.IO.Directory.GetFiles(wsdlPath, "*.wsdl");

"wsdlPath" is input from a textbox. Is this something that just can't be fixed? I can validate the path exists, etc. but how is that helping the vulnerability?

Answer

Eric Lippert picture Eric Lippert · Apr 10, 2012

If the data is always obtained from a text box whose contents are determined by the user, and the code runs using the permissions of that user, then the only threat is that of the user attacking themselves. That is not an interesting threat.

The vulnerability which the tool is attempting to alert you to is that if low-trust hostile code can determine the contents of that string then the hostile code can mount an attempt to discover facts about the user's machine, like "is such and such a program that I happen to know has a security vulnerability installed and unpatched?" or "is there a user named 'admin' on this machine?" and so on.

Related questions

Why is JsonRequestBehavior needed?

Why is Json Request Behavior needed? If I want to restrict the HttpGet requests to my action I can decorate the action with the [HttpPost] attribute Example: [HttpPost] public JsonResult Foo() { return Json("Secrets"); } // Instead of: public JsonResult Foo() { return …

Read More
Convert String to SecureString

How to convert String to SecureString?

Read More
How to convert SecureString to System.String?

All reservations about unsecuring your SecureString by creating a System.String out of it aside, how can it be done? How can I convert an ordinary System.Security.SecureString to System.String? I'm sure many of you who are familiar …

Read More