Path traversal is a vulnerability where attackers exploit insufficient validation of user-supplied file names to access restricted files, leading to information exposure and vulnerability chaining.
Major software like Zimbra and Apache HTTP Server have suffered from critical, unauthenticated path traversal vulnerabilities leading to widespread system compromise.
Attackers bypassed path normalization in the popular `st` NPM package using URL-encoded characters, a vulnerability fixed by first decoding the URI component and then normalizing the path.
The "Open in Default Browser" VS Code extension contained a path traversal flaw that allowed attackers to trick users into exfiltrating local files like SSH keys.
A specific version of the Node.js runtime had an improper path sanitization issue that made applications vulnerable to directory traversal by default.
Path traversal is an omnipresent risk that can be mitigated by understanding API function order and using automated security scanning tools directly in your IDE.
29:47Thomas Chauchefoin & Paul Gerste
30:54Martina Kraus
44:11Raul Onitza-Klugman & Kirill Efimov
28:41Alexander Pirker
26:59Jakub Andrzejewski
37:36Vandana Verma
27:41Liran Tal
2:08:06Antonio de Mello & Amine Abed
.png?w=240&auto=compress,format)
Jobs that call for the skills explored in this talk.
NTT DATA Deutschland GmbH
NTT DATA Deutschland GmbH
Green Tech Valley Cluster GmbH