What is a Directory / Path Traversal attack?

Short answer

Directory / Path Traversal is the attack of accessing files outside the intended directory (configuration, password, source code) by placing sequences that climb to the parent directory, such as ../, or their encoded forms into an input that the application uses as a file path; it occurs in applications that add the input to the file path without validating it (CWE-22). In TR7 WAF, the Directory/Path Traversal category (147 rules) of the built-in Signature & Rule Library looks for these sequences in the path, query, form, header, JSON, XML and raw body; the signature scan also scans the path, query and form values with their URL encoding decoded once; the URL Decoding setting of the vService (checked by default) decodes the path before all checks. The URL Normalization action in Load Balancer, on the other hand, simplifies /../ segments and forwards the request to the Backend Service with a consistent path.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	The Signature Category column (hidden by default); Filter → Signature Categories → Directory/Path Traversal	Listing the rules in the category; changing their state or score
vService → WAF Management → Checks	URL Decoding (checked by default)	URL-decoding the path once before all checks
WAF Event Logs and Global WAF Event Log	The Category column (hidden by default), the Category tab in the filter strip, the Category row on the Summary and Attacks tabs of the record preview	Seeing that the request was caught by a signature in this category
WAF Dashboard	The Detected Attacks by Category panel	The density of the detections in the category over time
WAF report	The Classification view	The category breakdown in the report
Load Balancer → Actions	URL Normalization → Re-evaluate path in accordance with two dot (..)	Simplifying the intermediate /../ segments before the request is forwarded to the Backend Service

• All the category names and rule counts: Which attack categories do the signatures cover?
• The CWE mapping of the signatures in the category is mostly from the CWE-22 family (e.g. CWE-24); the mapping of a signature is seen on the Classification tab in the preview of the rule: How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?

Common Misconceptions

• "Only the URL path is targeted." Every field that takes a file name or path as a parameter (query, form, JSON value) can be a target; the signatures of the category also work in these fields.
• "An encoded sequence bypasses the signature." The signature scan also scans the path and the query and form values with their URL encoding decoded once; the signatures of the category also recognize the encoded variants.
• "URL normalization blocks the attack." The action simplifies the path; it does not block the request, and the /../ segments at the beginning of the path are not removed. Blocking is the job of the WAF signatures.
• "Path traversal and LFI are the same." Path traversal is aimed at reading the file, LFI at getting the file included in the code the application runs: What are LFI and RFI (Local / Remote File Inclusion) attacks?

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Checks · URL Decoding
• Event Logs · The Filterable Information
• URL Normalization · Scenario 1: Simplifying the Directory References

Related questions

• Which attack categories do the signatures cover?
• What are LFI and RFI (Local / Remote File Inclusion) attacks?
• What are OWASP and the OWASP Top 10; where do they appear in the TR7 WAF?