Federal Agencies Urge Software Companies to Address Path Traversal Vulnerabilities Before Shipping
The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued a joint alert urging software companies to review their products for path traversal security vulnerabilities before shipping them to customers.
Path traversal vulnerabilities, also known as directory traversal, can be exploited by attackers to create or overwrite critical files used to execute code or bypass security mechanisms like authentication. This can potentially allow threat actors to access sensitive data, such as credentials, which may be used to compromise targeted systems.
According to the alert, technology manufacturers often fail to treat user-supplied content as potentially malicious, leaving their customers vulnerable to exploitation. Despite being identified as “unforgivable” since at least 2007, directory traversal vulnerabilities remain prevalent in software.
The warning from CISA and the FBI comes in response to recent incidents where threat actors exploited directory traversal vulnerabilities in software to compromise users in critical infrastructure sectors, including Healthcare and Public Health. For example, the ScreenConnect CVE-2024-1708 path traversal bug was used in conjunction with an authentication bypass flaw in Black Basta and Bl00dy ransomware attacks.
To prevent such vulnerabilities, software developers are advised to implement known mitigations, such as generating random identifiers for files, restricting the characters allowed in file names, and ensuring that uploaded files do not have executable permissions.
Path traversal vulnerabilities rank eighth in MITRE’s top 25 most dangerous software weaknesses, highlighting the importance of addressing these issues before they can be exploited by malicious actors. Earlier this year, CISA and the FBI also issued an alert urging software companies to prevent SQL injection vulnerabilities, which are ranked third in MITRE’s list of dangerous software weaknesses.
