How to Perform and Detect Path Injection Attacks

First of all, I am not a specialist in the subject, I am learning and having fun using AI tools.

That said... I was doing a development for a friend, he has a PDF with 100 sheets, with bank transaction records. You need to have these records in an excel to be able to process it later.

With the use of Github copilot, I made a script for data extraction using python and some libraries... Three doritos later... And as breakfast, lunch and dinner systems, I built a flask server, to serve the script through an endpoint in a front with html, css and js pure and simple.

During the interaction process with Copilot, an alert was raised that a part of the code had a "path injection" type vulnerability. This alert is quite interesting :D

And since I am looking to learn more about computer security, here I am blogging to leave a record of this journey...

Here the AI ​​begins to speak.

An attacker could exploit a path injection vulnerability by manipulating user input to access unauthorized files or directories on the server's file system. Here's an example of how you could do it:

Path Injection Example

Suppose you have a route in your Flask application that allows users to upload files and save them to the server. If you do not validate or sanitize the file name, an attacker could send a malicious file name to try to access sensitive files on the system.

Vulnerable Code

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = file.filename  # Nombre del archivo proporcionado por el usuario
    save_path = os.path.join('uploads', filename)

    # Guardar el archivo sin validar el nombre del archivo
    with open(save_path, 'wb') as f:
        f.write(file.read())

    return 'File uploaded successfully'

Path Injection Attack
An attacker could send a request with a malicious file name such as ../../etc/passwd. This could result in the following route:

uploads/../../etc/passwd

If the server does not validate or sanitize the file name, the file could be saved to an unwanted location, allowing the attacker to overwrite sensitive files on the system.

Solution: Validate and Sanitize the Entry
To avoid these types of attacks, you must validate and sanitize the file name before saving it. Here is a secure version of the code:

Secure Code

import os
import re
from flask import Flask, render_template, request, send_file
import requests
from datetime import datetime

app = Flask(__name__)

def sanitize_filename(filename):
    # Eliminar caracteres no permitidos del nombre del archivo
    return re.sub(r'[^a-zA-Z0-9_\-\.]', '', filename)

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    response = requests.post('http://127.0.0.1:5001/pdf-to-excel', files={'file': file})

    # Obtener la fecha actual
    current_date = datetime.now().strftime("%Y%m%d")

    # Obtener el nombre original del archivo sin la extensión
    original_filename = os.path.splitext(file.filename)[0]

    # Sanitizar el nombre del archivo
    sanitized_filename = sanitize_filename(original_filename)

    # Crear el nuevo nombre del archivo con la fecha al final
    output_filename = f'{sanitized_filename}_{current_date}.xlsx'

    # Crear la ruta completa del archivo
    save_path = os.path.join('uploads', output_filename)

    # Asegurarse de que la ruta sea absoluta
    save_path = os.path.abspath(save_path)

    # Guardar el archivo Excel resultante localmente con el nuevo nombre
    with open(save_path, 'wb') as f:
        f.write(response.content)

    # Enviar el archivo Excel de vuelta al usuario con el nuevo nombre
    return send_file(save_path, as_attachment=True, download_name=output_filename)

if __name__ == '__main__':
    app.run(port=5000, debug=True)

Secure Code Explanation
Sanitize File Name: The sanitize_filename function removes illegal characters from the file name using a regular expression.

Create the Full File Path: The os.path.join function is used to create the full file path, combining the destination directory (uploads) with the sanitized file name (output_filename).

Make sure the Path is Absolute: The os.path.abspath function converts the path to an absolute path to avoid manipulations with relative paths.

Save the File: Finally, the file is saved to the specified path.

Summary
Path Injection: An attacker can manipulate user input to access unauthorized files or directories.
Validation and Sanitization: Always validate and sanitize user input to avoid path injection attacks.
Absolute Routes: Use absolute routes to avoid manipulations with relative routes.
By following these practices, you can protect your application against path injection attacks and improve the overall security of your system.

Here I asked him how to carry out the attack. In addition, I left logs registered to be able to debug these cases.

To secure your application against path injection attacks, it is useful to understand how these attacks can be performed. Here I show you how an attacker could try to exploit your application and how you can detect these activities in the logs.

1. From the Browser

Manipulating HTML Forms
An attacker can manipulate an HTML form to submit a malicious file name.

Step by Step:

• Open the web page with the file upload form.
• Use the browser's developer tools (F12) to inspect the form.
• Modifies the value of the file field to include a malicious path, for example, ../../etc/passwd.
• Send the form.
• Detection in Logs: Records the name of the file received in the logs.

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = file.filename  # Nombre del archivo proporcionado por el usuario
    save_path = os.path.join('uploads', filename)

    # Guardar el archivo sin validar el nombre del archivo
    with open(save_path, 'wb') as f:
        f.write(file.read())

    return 'File uploaded successfully'

2. Using Tools like Postman

Sending Manipulated HTTP Requests
An attacker can use Postman to send crafted HTTP requests directly to the server.

Step by Step:

• Open Postman and configure a POST request to http://127.0.0.1:5000/upload.
• In the body of the request, select form-data and add a file field with a file whose name is ../../etc/passwd.
• Submit the request.
• Detection in Logs: Records the name of the file received in the logs.

3. Through Automated Scripts

Using Python Scripts
An attacker can use Python scripts to send malicious HTTP requests.

Python Script Example:

import os
import re
from flask import Flask, render_template, request, send_file
import requests
from datetime import datetime

app = Flask(__name__)

def sanitize_filename(filename):
    # Eliminar caracteres no permitidos del nombre del archivo
    return re.sub(r'[^a-zA-Z0-9_\-\.]', '', filename)

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    response = requests.post('http://127.0.0.1:5001/pdf-to-excel', files={'file': file})

    # Obtener la fecha actual
    current_date = datetime.now().strftime("%Y%m%d")

    # Obtener el nombre original del archivo sin la extensión
    original_filename = os.path.splitext(file.filename)[0]

    # Sanitizar el nombre del archivo
    sanitized_filename = sanitize_filename(original_filename)

    # Crear el nuevo nombre del archivo con la fecha al final
    output_filename = f'{sanitized_filename}_{current_date}.xlsx'

    # Crear la ruta completa del archivo
    save_path = os.path.join('uploads', output_filename)

    # Asegurarse de que la ruta sea absoluta
    save_path = os.path.abspath(save_path)

    # Guardar el archivo Excel resultante localmente con el nuevo nombre
    with open(save_path, 'wb') as f:
        f.write(response.content)

    # Enviar el archivo Excel de vuelta al usuario con el nuevo nombre
    return send_file(save_path, as_attachment=True, download_name=output_filename)

if __name__ == '__main__':
    app.run(port=5000, debug=True)

Detection in Logs: Records the name of the file received in the logs.

Implementation of Logs for Detection
Here is a complete implementation that includes logging to detect suspicious file names:

@app.route('/upload', methods=['POST'])
def upload():
    file = request.files['file']
    filename = file.filename  # Nombre del archivo proporcionado por el usuario
    save_path = os.path.join('uploads', filename)

    # Guardar el archivo sin validar el nombre del archivo
    with open(save_path, 'wb') as f:
        f.write(file.read())

    return 'File uploaded successfully'

Summary
From the Browser: Manipulating HTML forms or using browser development tools.
Using Tools like Postman: Sending crafted HTTP requests directly to the server.
Using Automated Scripts: Using scripts in Python, Bash, or any other language to send malicious HTTP requests.
Log Detection: Records the name of the received file and other suspicious activities in the logs to detect possible attacks.
By implementing these measures, you can improve the security of your application and detect suspicious activities that could indicate an attempted attack.

Conclusion: Under this context of learning and development doing pair programming with AI, I find this type of alerts on the platform extremely useful to detect vulnerabilities. Today I woke up thinking I was going to deploy Heroku back and here I find myself discovering different vulnerabilities :D

happy coding!

The above is the detailed content of How to Perform and Detect Path Injection Attacks. For more information, please follow other related articles on the PHP Chinese website!