Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

False Positive - Path Traversal #8379

Open
njmulsqb opened this issue Mar 4, 2024 · 2 comments · May be fixed by zaproxy/zap-extensions#5824
Open

False Positive - Path Traversal #8379

njmulsqb opened this issue Mar 4, 2024 · 2 comments · May be fixed by zaproxy/zap-extensions#5824
Assignees
@kingthorin
Labels
add-on FalsePositive

Comments

@njmulsqb
Copy link
Contributor

njmulsqb commented Mar 4, 2024

Reporting the FP as per https://www.zaproxy.org/faq/how-do-i-handle-a-false-positive/

ZAP is triggering the path traversal alert which is a false-positive.

The request is to the login form and the response contains highlighted content from JS script. The JS script is huge and it is completely highlighted. The evidence is etc and it is in a string like this
image

I have saved the session file with me, if you need more information to diagnose the problem let me know.
@psiinon
Copy link
Member

psiinon commented Mar 4, 2024

Ow. Yeah, we should try to avoid matching that sort of response...

@kingthorin kingthorin self-assigned this Sep 6, 2024
@kingthorin
Copy link
Member

kingthorin commented Oct 16, 2024 •
edited
Loading

To be clear the rule actually requires that five different strings (pattens) are matched:

https://github.com/zaproxy/zap-extensions/blob/14bcf8559b20e8b658a3c7385d5b7365e345fd4e/addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/PathTraversalScanRule.java#L719-L725

Although etc is the only evidence that can be matched due to the way ZAP handles evidence.

It seems quite unlikely that responses are going to cover all five checks and not be valid traversals. While obviously not impossible as seen here.

We could definitely include further details in the Other Info field and should probably exclude js/css responses.

@kingthorin kingthorin linked a pull request Oct 17, 2024 that will close this issue
Open
7 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kingthorin kingthorin

Labels
add-on FalsePositive
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

ascanrules: Path Traversal add details for dir match Alerts & reduce FPs kingthorin/zap-extensions
3 participants
@psiinon @kingthorin @njmulsqb