Path Manipulation: Base Path Overwriting

Allowing user input to control paths used in file system operations could enable an attacker to access or modify otherwise protected system resources.

Path.Combine takes several file paths as arguments. It concatenates them to get a full path, which is typically followed by a call to read() or write() to that file. The documentation describes several different scenarios based on whether the first or remaining parameters are absolute paths. Given an absolute path for the second or remaining parameters, Path.Combine() will return that absolute path. The previous parameters will be ignored. The implications here are significant for applications that have code similar to the following example.


Example 1: The following code insecurely loads a file with user-controlled path elements:

  // Called with user-controlled data
  public static bytes[] getFile(String filename) 
  {
    String imageDir = "\\FILESHARE\images\";
    filepath = Path.Combine(imageDir, filename);
    return File.ReadAllBytes(filepath);
  }

By providing an absolute path (e.g. C:\\inetpub\wwwroot\web.config), an attacker could control which file gets returned by the application.