PathTraversalController.java

package com.example.vulnerable;

import org.springframework.web.bind.annotation.*;
import org.springframework.core.io.Resource;
import org.springframework.core.io.UrlResource;
import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseEntity;
import java.io.*;
import java.nio.file.*;
import java.util.*;

/**
 * VULNERABLE: Path Traversal Vulnerabilities
 * 
 * Demonstrates multiple path traversal attack vectors that allow
 * attackers to read arbitrary files from the server.
 * 
 * Related CVEs:
 * - CVE-2021-22060: Spring Framework Path Traversal
 * - CVE-2021-29425: Apache Commons IO Path Traversal
 * 
 * CWE-22: Improper Limitation of a Pathname to a Restricted Directory
 * CVSS Score: 7.5 (HIGH)
 * 
 * Impact:
 * - Read sensitive files (/etc/passwd, application.properties)
 * - Access source code
 * - Read configuration files
 * - Information disclosure
 * 
 * WARNING: This code is intentionally vulnerable for educational purposes.
 * DO NOT deploy to production!
 */
@RestController
@RequestMapping("/api/files")
public class PathTraversalController {

    private static final String BASE_DIR = "uploads/";

    /**
     * VULNERABLE: Path Traversal via filename parameter
     * 
     * CVE: Related to CVE-2021-22060 (Spring Framework)
     * CWE-22: Path Traversal
     * CVSS: 7.5 (HIGH)
     * 
     * Attack Examples:
     * - /api/files/read?filename=../../../etc/passwd
     * - /api/files/read?filename=..\..\..\..\windows\system32\config\sam
     * - /api/files/read?filename=../../../../application.properties
     * - /api/files/read?filename=../../src/main/resources/application.yml
     * 
     * Impact: Read any file on the server
     */
    @GetMapping("/read")
    public Map<String, Object> readFile(@RequestParam String filename) {
        try {
            // CRITICAL VULNERABILITY: No path validation
            File file = new File(BASE_DIR + filename);  // ❌ CWE-22
            
            if (!file.exists()) {
                return Map.of(
                    "success", false,
                    "error", "File not found",
                    "path", file.getAbsolutePath()
                );
            }
            
            // Read file content
            String content = new String(Files.readAllBytes(file.toPath()));
            
            return Map.of(
                "success", true,
                "filename", filename,
                "path", file.getAbsolutePath(),
                "content", content,
                "size", file.length(),
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
        }
    }

    /**
     * VULNERABLE: Path Traversal via download endpoint
     * 
     * CVE: Related to CVE-2021-22060 (Spring Framework)
     * CWE-22: Path Traversal
     * CVSS: 7.5 (HIGH)
     * 
     * Attack Examples:
     * - /api/files/download?file=../../../etc/shadow
     * - /api/files/download?file=../../../../root/.ssh/id_rsa
     * - /api/files/download?file=../../pom.xml
     * 
     * Impact: Download any file from the server
     */
    @GetMapping("/download")
    public ResponseEntity<Resource> downloadFile(@RequestParam String file) {
        try {
            // CRITICAL VULNERABILITY: No path validation
            Path filePath = Paths.get(BASE_DIR).resolve(file);  // ❌ CWE-22
            Resource resource = new UrlResource(filePath.toUri());
            
            if (!resource.exists()) {
                return ResponseEntity.notFound().build();
            }
            
            return ResponseEntity.ok()
                .header(HttpHeaders.CONTENT_DISPOSITION, 
                        "attachment; filename=\"" + resource.getFilename() + "\"")
                .body(resource);
                
        } catch (Exception e) {
            return ResponseEntity.badRequest().build();
        }
    }

    /**
     * VULNERABLE: Path Traversal via file listing
     * 
     * CWE-22: Path Traversal
     * CVSS: 5.3 (MEDIUM)
     * 
     * Attack Examples:
     * - /api/files/list?directory=../../../etc
     * - /api/files/list?directory=../../src
     * 
     * Impact: List contents of any directory
     */
    @GetMapping("/list")
    public Map<String, Object> listFiles(@RequestParam String directory) {
        try {
            // CRITICAL VULNERABILITY: No path validation
            File dir = new File(BASE_DIR + directory);  // ❌ CWE-22
            
            if (!dir.exists() || !dir.isDirectory()) {
                return Map.of(
                    "success", false,
                    "error", "Directory not found",
                    "path", dir.getAbsolutePath()
                );
            }
            
            File[] files = dir.listFiles();
            List<Map<String, Object>> fileList = new ArrayList<>();
            
            if (files != null) {
                for (File f : files) {
                    fileList.add(Map.of(
                        "name", f.getName(),
                        "type", f.isDirectory() ? "directory" : "file",
                        "size", f.length(),
                        "path", f.getAbsolutePath()
                    ));
                }
            }
            
            return Map.of(
                "success", true,
                "directory", directory,
                "path", dir.getAbsolutePath(),
                "files", fileList,
                "count", fileList.size(),
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
        }
    }

    /**
     * VULNERABLE: Path Traversal via file deletion
     * 
     * CWE-22: Path Traversal
     * CVSS: 8.1 (HIGH)
     * 
     * Attack Examples:
     * - /api/files/delete?filename=../../../important-file.txt
     * - /api/files/delete?filename=../../application.properties
     * 
     * Impact: Delete any file on the server
     */
    @DeleteMapping("/delete")
    public Map<String, Object> deleteFile(@RequestParam String filename) {
        try {
            // CRITICAL VULNERABILITY: No path validation
            File file = new File(BASE_DIR + filename);  // ❌ CWE-22
            
            if (!file.exists()) {
                return Map.of(
                    "success", false,
                    "error", "File not found",
                    "path", file.getAbsolutePath()
                );
            }
            
            boolean deleted = file.delete();
            
            return Map.of(
                "success", deleted,
                "filename", filename,
                "path", file.getAbsolutePath(),
                "message", deleted ? "File deleted" : "Failed to delete file",
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
        }
    }

    /**
     * VULNERABLE: Path Traversal via file upload
     * 
     * CVE: Related to CVE-2021-29425 (Apache Commons IO)
     * CWE-22: Path Traversal
     * CVSS: 7.5 (HIGH)
     * 
     * Attack Examples:
     * - Upload with filename: ../../../evil.jsp
     * - Upload with filename: ../../webapps/shell.war
     * 
     * Impact: Write files to arbitrary locations
     */
    @PostMapping("/upload")
    public Map<String, Object> uploadFile(
            @RequestParam String filename,
            @RequestBody String content) {
        try {
            // CRITICAL VULNERABILITY: No path validation
            File file = new File(BASE_DIR + filename);  // ❌ CWE-22
            
            // Create parent directories if needed
            file.getParentFile().mkdirs();
            
            // Write content to file
            Files.write(file.toPath(), content.getBytes());
            
            return Map.of(
                "success", true,
                "filename", filename,
                "path", file.getAbsolutePath(),
                "size", file.length(),
                "message", "File uploaded successfully",
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", e.getMessage(),
                "warning", "VULNERABLE: Path traversal (CWE-22)"
            );
        }
    }

    /**
     * Information endpoint showing vulnerability details
     */
    @GetMapping("/info")
    public Map<String, Object> vulnerabilityInfo() {
        return Map.of(
            "vulnerability", "Path Traversal",
            "cwe", "CWE-22",
            "cvss", "7.5 (HIGH)",
            "related_cves", Arrays.asList(
                "CVE-2021-22060 (Spring Framework)",
                "CVE-2021-29425 (Apache Commons IO)"
            ),
            "description", "Improper limitation of a pathname to a restricted directory",
            "impact", Arrays.asList(
                "Read sensitive files",
                "Access source code",
                "Read configuration files",
                "Delete arbitrary files",
                "Write files to arbitrary locations"
            ),
            "vulnerable_endpoints", Arrays.asList(
                "GET /api/files/read?filename=...",
                "GET /api/files/download?file=...",
                "GET /api/files/list?directory=...",
                "DELETE /api/files/delete?filename=...",
                "POST /api/files/upload"
            ),
            "attack_examples", Arrays.asList(
                "/api/files/read?filename=../../../etc/passwd",
                "/api/files/read?filename=../../../../application.properties",
                "/api/files/download?file=../../pom.xml",
                "/api/files/list?directory=../../../etc",
                "/api/files/delete?filename=../../important-file.txt"
            ),
            "mitigation", Arrays.asList(
                "Validate and sanitize file paths",
                "Use allowlist of allowed directories",
                "Resolve canonical paths",
                "Check if resolved path is within allowed directory",
                "Use Path.normalize() and validate result"
            ),
            "references", Arrays.asList(
                "https://cwe.mitre.org/data/definitions/22.html",
                "https://owasp.org/www-community/attacks/Path_Traversal"
            )
        );
    }

    /**
     * FIXED VERSION: Safe file reading with path validation
     */
    @GetMapping("/safe-read")
    public Map<String, Object> safeReadFile(@RequestParam String filename) {
        try {
            // SAFE: Validate filename
            if (filename.contains("..") || filename.contains("/") || filename.contains("\\")) {
                return Map.of(
                    "success", false,
                    "error", "Invalid filename",
                    "message", "Filename cannot contain path traversal characters"
                );
            }
            
            // SAFE: Resolve canonical path and validate
            Path basePath = Paths.get(BASE_DIR).toRealPath();
            Path filePath = basePath.resolve(filename).normalize();
            
            // SAFE: Check if file is within allowed directory
            if (!filePath.startsWith(basePath)) {
                return Map.of(
                    "success", false,
                    "error", "Access denied",
                    "message", "File must be within allowed directory"
                );
            }
            
            File file = filePath.toFile();
            
            if (!file.exists()) {
                return Map.of(
                    "success", false,
                    "error", "File not found"
                );
            }
            
            String content = new String(Files.readAllBytes(file.toPath()));
            
            return Map.of(
                "success", true,
                "filename", filename,
                "content", content,
                "size", file.length(),
                "security", "Path validated and sanitized"
            );
            
        } catch (Exception e) {
            return Map.of(
                "success", false,
                "error", "Failed to read file",
                "message", e.getMessage()
            );
        }
    }
}