CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
A web application has a file download endpoint: GET /api/download?file=report_2024.pdf. An attacker submits ?file=../../../../etc/shadow. The server reads and returns the file. Which OWASP vulnerability enables this and what is the first line of defense?
- A.SSRF - the server is fetching from an internal URL
- B.SQL injection via the file parameter
- C.Path Traversal (related to OWASP A01 Broken Access Control) - the attacker uses '../' sequences to escape the intended directory. First defense: canonicalize the path and verify it starts with the allowed base directory after resolution; second: use an allowlist of permitted filenames rather than accepting arbitrary paths
- D.XML External Entity injection via the file download
Why C is correct
Path traversal exploits inadequate path sanitization: '../' sequences navigate up the directory tree. Prevention: (1) resolve the absolute path with Path.resolve() or realpath() and verify it starts with the expected base directory - this catches encoded traversal (%2F, %252F) after canonicalization; (2) use an allowlist approach where the file parameter maps to an internal identifier, not a literal path; (3) store user files with UUID names in a dedicated bucket, not the filesystem.
Know someone studying for Web App Fundamentals? Send them this one.