SY0-701 Question 117
Single answerApplication attacks: Injection , Buffer overflow , Replay , Privilege escalation , Forgery , Directory traversalA company deploys a web application that lets authenticated users download invoices by requesting a file path from the application server. During testing, a security analyst intercepts a request and changes the parameter from /invoices/2026/INV-1042.pdf to ../../../../etc/passwd. The server responds with system account data instead of an invoice. Which of the following attacks is being demonstrated?
- A
Directory traversal
- B
Replay attack
- C
Privilege escalation
- D
Buffer overflow
Show answer and explanation
Correct answer: A
Explanation
This is a directory traversal attack, sometimes called path traversal. The defining behavior is the use of relative path sequences like ../ to move outside the application's intended directory and access arbitrary files on the host system. This is a common application attack caused by insufficient input validation and insecure file access logic. Effective mitigations include allowing only known-safe filenames, mapping user requests to internal identifiers instead of direct paths, normalizing and validating paths, enforcing least privilege on the application account, and restricting file system access through OS permissions. OWASP guidance on Path Traversal recommends input validation, avoiding direct use of user-supplied paths, and implementing proper access controls. This differs from replay, buffer overflow, and privilege escalation because the core issue is unauthorized file access through manipulated path input.
- A. Correct.
Correct. Directory traversal occurs when an attacker manipulates file path input to access files and directories outside the intended location. The use of sequences such as ../ is a classic indicator. In this scenario, the attacker escapes the invoice directory and retrieves /etc/passwd, which is a sensitive system file on Unix-like systems.
- B. Incorrect.
Incorrect. A replay attack involves capturing valid data transmissions, such as authentication tokens or session exchanges, and retransmitting them to gain unauthorized access or repeat an action. This scenario does not involve reusing a captured transaction; it involves modifying a file path parameter to access unintended resources.
- C. Incorrect.
Incorrect. Privilege escalation occurs when a user or process gains permissions beyond those originally assigned, such as a standard user obtaining administrative rights. Although the attacker accessed unauthorized data, the method shown is path manipulation, not an elevation of assigned privileges through a permissions flaw or exploit.
- D. Incorrect.
Incorrect. A buffer overflow happens when a program writes more data to a buffer than it can safely hold, potentially causing crashes or arbitrary code execution. The scenario shows improper input validation of a file path, not memory corruption caused by oversized input.