Which action is the appropriate countermeasure for directory traversal vulnerabilities?

Which action is the appropriate countermeasure for directory traversal vulnerabilities?

• A. Strongly validate user input.
• B. Keep your OS up to date.
• C. Implement cookie's timeout.
• D. Define access rights.

Answer: (D)

Directory traversal is stopped most effectively by enforcing strict access controls on the resources the application can read. By defining who can access which files and ensuring the web server or application runs with only the minimal privileges needed, any attempt to reach files outside the permitted area is blocked by the operating system’s permissions. Even if an attacker manipulates the path, the server won’t be able to read restricted files because the filesystem permissions deny access. This approach provides a solid defense because it limits what can be accessed at the source, independent of how the input is crafted. Relying solely on input validation can be circumvented by tricky encodings or bypasses, and keeping the OS updated or handling session timeouts doesn’t directly prevent unauthorized file access through directory traversal.

Directory traversal is stopped most effectively by enforcing strict access controls on the resources the application can read. By defining who can access which files and ensuring the web server or application runs with only the minimal privileges needed, any attempt to reach files outside the permitted area is blocked by the operating system’s permissions. Even if an attacker manipulates the path, the server won’t be able to read restricted files because the filesystem permissions deny access. This approach provides a solid defense because it limits what can be accessed at the source, independent of how the input is crafted.

Relying solely on input validation can be circumvented by tricky encodings or bypasses, and keeping the OS updated or handling session timeouts doesn’t directly prevent unauthorized file access through directory traversal.