SY0-701 Question 116
Single answerApplication attacks: Injection , Buffer overflow , Replay , Privilege escalation , Forgery , Directory traversalA company discovers that an internally developed web application allows authenticated users to download invoices by passing a filename in the URL, such as /download?file=invoice-1042.pdf. During testing, a security analyst changes the parameter to ../../../../etc/passwd and successfully retrieves sensitive system files from the web server. Which of the following best describes this attack?
- A
Directory traversal
- B
Replay attack
- C
Buffer overflow
- D
Privilege escalation
- E
Injection
Show answer and explanation
Correct answer: A
Explanation
The best answer is directory traversal. The telltale sign is the use of ../ sequences to navigate outside the application's intended directory and access arbitrary files on the server. This weakness typically results from insufficient input validation and insecure file path construction. Common mitigations include allowlisting expected filenames or identifiers, avoiding direct user control over filesystem paths, canonicalizing paths before use, restricting the application's filesystem permissions, and storing downloadable files outside sensitive system paths. This aligns with widely accepted secure coding guidance such as OWASP recommendations on Path Traversal and general input validation best practices.
- A. Correct.
Correct. Directory traversal occurs when an attacker manipulates file path input, often using sequences such as ../, to access files and directories outside the intended location. In this scenario, the attacker abuses the file parameter to move up the directory structure and retrieve sensitive operating system files, which is a classic path traversal condition.
- B. Incorrect.
Incorrect. A replay attack involves capturing legitimate authentication or transaction data and retransmitting it to gain unauthorized access or repeat an action. Nothing in this scenario involves resending captured traffic or tokens; the issue is improper validation of a file path parameter.
- C. Incorrect.
Incorrect. A buffer overflow occurs when an application writes more data to memory than a buffer can safely hold, potentially causing crashes or arbitrary code execution. The scenario describes unauthorized file access through manipulated path input, not memory corruption.
- D. Incorrect.
Incorrect. Privilege escalation is the act of gaining higher permissions than originally granted, such as moving from a standard user account to administrative rights. Although accessing sensitive files may increase the impact of the incident, the specific vulnerability being exploited here is not privilege escalation itself.
- E. Incorrect.
Incorrect. Injection attacks involve sending untrusted data to an interpreter, such as SQL, LDAP, or OS command injection, causing unintended commands or queries to execute. While both injection and directory traversal involve poor input validation, this example specifically targets file path handling rather than an interpreter.