Absolute Path Injection

import os
 
# Developer intent: restrict file access to /uploads/ directory
BASE = "/var/www/uploads"
 
def vulnerable_open(user_input):
    # VULNERABLE: os.path.join discards BASE when user_input starts with /
    path = os.path.join(BASE, user_input)
    return open(path, "rb")
 
# Result of os.path.join("/var/www/uploads", "/etc/passwd")
# → "/etc/passwd"   (BASE is completely discarded)
print(os.path.join("/var/www/uploads", "/etc/passwd"))
# /etc/passwd

# Same behavior in Python's pathlib
from pathlib import Path
base = Path("/var/www/uploads")
result = base / "/etc/passwd"
print(result)
# /etc/passwd

const path = require('path');
// path.resolve discards all preceding arguments when an absolute path is encountered
console.log(path.resolve('/var/www/uploads', '/etc/passwd'));
// /etc/passwd
 
// path.join does NOT behave this way — it normalizes the full string
console.log(path.join('/var/www/uploads', '/etc/passwd'));
// /var/www/uploads/etc/passwd  (note: still dangerous if not validated)

from urllib.parse import urljoin
 
# When the second argument starts with /, the first URL's path is replaced
print(urljoin("https://api.internal/v1/reports/", "/etc/passwd"))
# https://api.internal/etc/passwd
 
# Attack in a microservice proxy context
base_url = "https://internal-api.corp/api/v2/"
user_path = "/admin/users"
# Result: https://internal-api.corp/admin/users
# The /api/v2/ prefix is silently discarded

GET /proxy?path=/admin/users HTTP/1.1
Host: app.example.com
 
HTTP/1.1 200 OK
Content-Type: application/json
 
{"users": [...all users including admins...]}

/etc/passwd                         → user enumeration
/proc/self/environ                  → runtime secrets (cloud keys, DB URLs, API tokens)
/proc/self/cmdline                  → running process identification
/proc/version                       → kernel version for exploit selection
/app/.env                           → all application secrets in one file
/home/ubuntu/.ssh/id_rsa            → SSH private key
/home/ubuntu/.aws/credentials       → AWS credential file
/var/run/secrets/kubernetes.io/serviceaccount/token  → Kubernetes JWT

C:\Windows\win.ini                  → filesystem access confirmation marker ([fonts])
C:\inetpub\wwwroot\web.config       → ASP.NET connection strings, secret keys
C:\Windows\System32\drivers\etc\hosts  → internal hostnames

import os
 
BASE_DIR = os.path.realpath("/var/www/app/uploads")
 
def safe_open(user_input: str) -> bytes:
    # Join first, then resolve — this neutralizes both relative and absolute injection
    full_path = os.path.join(BASE_DIR, user_input)
    resolved = os.path.realpath(full_path)
    
    # os.path.realpath on os.path.join("/uploads", "/etc/passwd")
    # → full_path = "/etc/passwd" (join discards base)
    # → resolved = "/etc/passwd"
    # → startsWith check FAILS → exception raised
    if not resolved.startswith(BASE_DIR + os.sep):
        raise PermissionError("Absolute path injection blocked")
    
    with open(resolved, "rb") as f:
        return f.read()

// Node.js — path.resolve then validate
const path = require('path');
const fs = require('fs');
const BASE = fs.realpathSync('/var/www/uploads');
 
function safeRead(userInput) {
    // path.resolve handles both absolute components and .. sequences
    const resolved = path.resolve(BASE, userInput);
    const real = fs.realpathSync(resolved);
    if (!real.startsWith(BASE + path.sep)) {
        throw new Error('Access denied: absolute path injection attempt');
    }
    return fs.readFileSync(real);
}

from urllib.parse import urljoin, urlparse
 
INTERNAL_BASE = "https://internal-api.corp/api/v2/"
 
def safe_proxy(user_path: str) -> str:
    # Reject paths that start with / to prevent urljoin base override
    if user_path.startswith("/"):
        raise ValueError("Absolute path not permitted in proxy parameter")
    # Additionally: allowlist path prefixes
    allowed_prefixes = ["reports/", "documents/", "exports/"]
    if not any(user_path.startswith(p) for p in allowed_prefixes):
        raise ValueError("Path not in allowed prefix list")
    return urljoin(INTERNAL_BASE, user_path)

import uuid
from typing import Optional
 
# File registry: UUID → real path
FILE_REGISTRY: dict[str, str] = {}
 
def register_file(real_path: str) -> str:
    file_id = str(uuid.uuid4())
    FILE_REGISTRY[file_id] = real_path
    return file_id
 
def get_file(file_id: str) -> Optional[bytes]:
    path = FILE_REGISTRY.get(file_id)
    if path is None:
        return None
    with open(path, "rb") as f:
        return f.read()