Basically, if you add a …/ in a query, you can start to work backwards in the directory tree to root, then go up again to someplace you shouldn’t go. The firewall doesn’t block this attack, cause it’s just doing a regular HTTP(s) request.
How would a firewall be related to this? A firewall would block/allow the ports 80/443 from certain sources. That’s it. Whatever is happening here it’s related to OS permissions and web server configuration.
Because enterpise firewalls suck ass. If you follow some security researchers on fedi it is shockingly common. Like every week there is an unauth RCE to these things and usually its …/. Is it absurd that a companies expensive first line defense is less secure than your mum’s laptop? I’m sure it is “AI” ready though!
It’s called a Path Traversal attack.
Basically, if you add a …/ in a query, you can start to work backwards in the directory tree to root, then go up again to someplace you shouldn’t go. The firewall doesn’t block this attack, cause it’s just doing a regular HTTP(s) request.
https://owasp.org/www-community/attacks/Path_Traversal
How would a firewall be related to this? A firewall would block/allow the ports 80/443 from certain sources. That’s it. Whatever is happening here it’s related to OS permissions and web server configuration.
Because enterpise firewalls suck ass. If you follow some security researchers on fedi it is shockingly common. Like every week there is an unauth RCE to these things and usually its …/. Is it absurd that a companies expensive first line defense is less secure than your mum’s laptop? I’m sure it is “AI” ready though!
It’s referring to a Web Application Firewall.