Path Traversal i LFI: Kako napadači čitaju fajlove sa vašeg servera

← Blog

Šta je Path Traversal?

Path Traversal (Directory Traversal) je napad u kome napadač manipuliše putanjom fajla u URL-u ili parametru da bi pristupio fajlovima van namenjenog direktorijuma. Sekvenca ../ (dot-dot-slash) pomera "gore" u hijerarhiji direktorijuma.

Klasičan primer

Aplikacija prikazuje slike ovako: https://sajt.rs/files?name=slika.jpg

Napadač menja zahtev u: https://sajt.rs/files?name=../../../../etc/passwd

Ako aplikacija ne sanitizuje putanju, server vraća sadržaj /etc/passwd — listu korisnika sistema.

Šta je LFI (Local File Inclusion)?

LFI je specifičan oblik path traversal kod PHP aplikacija: napadač može da "uključi" (include) lokalni fajl u izvršavanje PHP skripte. Ovo je ozbiljnije od čitog čitanja jer inkludovani fajl se izvršava kao PHP kod.

// Ranjivi PHP kod:
$page = $_GET['page'];
include($page . '.php');

Zahtev: /index.php?page=../../../../etc/passwd%00

%00 je null byte koji "odseca" .php nastavak na starijim PHP verzijama.

Šta napadač može da pročita

• /etc/passwd — lista korisnika (Linux)
• /etc/shadow — hash lozinki (root pristup potreban)
• .env — API ključevi, DB lozinke, tajni ključevi
• config.php, wp-config.php — database kredencijali
• /proc/self/environ — environment varijable procesa
• ~/.ssh/id_rsa — SSH privatni ključ
• Apache/Nginx access logovi — potencijalni put do RCE

Tipična mesta ranjivosti

• Parametri za preuzimanje fajlova: ?file=, ?doc=, ?path=
• Template sistemi koji učitavaju fajlove na osnovu URL parametra
• Sistemi za administraciju koji prikazuju logove
• Include/require u PHP bez validacije
• Backup i restore funkcionalnosti

Odbrana

1. Whitelist dozvoljenih putanja

Nikada ne konstruišite putanje fajlova direktno iz korisničkog unosa. Koristite whitelist: dozvolite samo tačno definisane vrednosti.

$allowed = ['home', 'about', 'contact'];
if (!in_array($page, $allowed)) {
    die('Invalid page');
}
include($page . '.php');

2. Canonicalize putanje

Koristite realpath() i proverite da li rezultujuća putanja počinje dozvoljenim baznim direktorijumom.

$base = '/var/www/html/files/';
$path = realpath($base . $filename);
if (strpos($path, $base) !== 0) {
    die('Access denied');
}

3. Onemogućite null byte obradu

Na PHP 5.3+, null byte u putanji generiše grešku. Svakako filtrirajte \0 iz korisničkog unosa.

4. Minimalna privilegija za web server

Web server proces treba da ima pristup samo fajlovima neophodnim za rad aplikacije — ne /etc/, ne home direktorijumima korisnika, ne logovima sistema.

5. Onemogućite include wrappers (PHP)

U php.ini: allow_url_include = Off — sprečava Remote File Inclusion (RFI).

← Blog

What Is Path Traversal?

Path Traversal (Directory Traversal) is an attack where an attacker manipulates a file path in a URL or parameter to access files outside the intended directory. The ../ (dot-dot-slash) sequence moves "up" in the directory hierarchy.

Classic Example

The application displays images like this: https://site.com/files?name=image.jpg

The attacker changes the request to: https://site.com/files?name=../../../../etc/passwd

If the application does not sanitize the path, the server returns the contents of /etc/passwd — the list of system users.

What Is LFI (Local File Inclusion)?

LFI is a specific form of path traversal in PHP applications: the attacker can "include" a local file in the execution of a PHP script. This is more serious than plain reading because the included file is executed as PHP code.

// Vulnerable PHP code:
$page = $_GET['page'];
include($page . '.php');

What an Attacker Can Read

• /etc/passwd — list of system users (Linux)
• /etc/shadow — password hashes (requires root access)
• .env — API keys, DB passwords, secret keys
• config.php, wp-config.php — database credentials
• /proc/self/environ — process environment variables
• ~/.ssh/id_rsa — SSH private key

Defense

1. Whitelist Allowed Paths

Never construct file paths directly from user input. Use a whitelist: allow only exactly defined values.

$allowed = ['home', 'about', 'contact'];
if (!in_array($page, $allowed)) {
    die('Invalid page');
}
include($page . '.php');

2. Canonicalize Paths

Use realpath() and verify that the resulting path begins with the allowed base directory.

$base = '/var/www/html/files/';
$path = realpath($base . $filename);
if (strpos($path, $base) !== 0) {
    die('Access denied');
}

3. Minimal Privilege for the Web Server

The web server process should only have access to files necessary for the application to function — not /etc/, not user home directories, not system logs.