PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Path Traversal in 2024 - The year unpacked

aikido.dev | blog | #web-security | #path-traversal | #input-validation | #vulnerability-statistics | #directory-traversal
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Path traversal is ancient but trending the wrong way: 2.7% of 2024 open-source vulnerabilities, closed-source up 85%. The post shows how ../ attacks reach /etc/passwd and how to stop them.
Published
Collected

Related coverage

blog · aikido.dev
Command injection in 2024 unpacked
Unvalidated input passed to system functions still enables arbitrary command execution. Aikido research finds command injection at 7% of 2024 open-source vulnerabilities—still surprisingly common.
blog · aikido.dev
The State of SQL Injection
SQL injection predates Internet Explorer, yet 6.7% of 2024 open-source vulnerabilities were SQLi and over 20% of scanned closed-source projects remain vulnerable. The MOVEit breach proves the point.
vulnerability · hackerone.com
Preventing Directory Traversal Attacks: Techniques and Tips for Secure File Access
HackerOne explains how directory traversal via ../ sequences reaches files outside the web root, and walks through mitigations: strict validation, allow lists, and framework protections.
blog · aikido.dev
Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained
Prisma queries accept operator objects that attackers can abuse, so crafted input can bypass password checks even on PostgreSQL. The post demonstrates operator injection exploits and defenses.
blog · aikido.dev
Webhook security checklist: How to build secure webhooks
Carelessly built webhooks invite SSRF and data leaks. The checklist covers URL validation, blocking local addresses, limiting log exposure, and HMAC payload verification for consumer trust.
blog · aikido.dev
Top 3 web application security vulnerabilities in 2024
Aikido ranks the top three web application vulnerabilities among its users, starting with NoSQL injection, explaining why each is common, how to fix them, and risky runner-up flaws to watch.
Back