Proving and Blocking Filesystem Path Traversal Without Host Modification
A download endpoint accepts relative dot-slash sequences, letting a caller step outside the public folder and read private server files. The verifier proves directory escape using a benign sandbox fixture and immediately compiles a canonical path-boundary check.
Filesystem path traversal occurs when a service resolves a user-supplied filename without verifying that the canonical target path remains inside the designated storage directory. Attackers exploit parent-directory sequences and percent-encoded slashes to read configuration files, private keys, or source code.
1. Interception and Rule Synthesis Schematic for DIR-TRV
Verification sequence for DIR-TRV: candidate probe inspection by wire rule SEC-ZD-FS-01, differential confirmation via witness a17dfc4aef33a97d, and compilation of gateway contract IMMUNE-FS-A17DFC4A.
2. In-Path Mutation Blocking and Paired Decoy Verification (DIR-TRV)
The in-path software filter enforces strict read-only probing under rule SEC-ZD-FS-01. Any request that attempts file creation, permission modification, symlink replacement, or access to sensitive operating system credential stores is blocked before reaching the socket.
During benchmark execution, the verifier tests relative path normalization against both vulnerable handlers and protected endpoints that enforce canonical prefix checks. All four testbed cases are classified with 100 percent precision and recall, yielding two true positives and two true negatives.
Class Identifier: DIR-TRV (path_traversal)
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: GET /api/v1/vuln/traversal/report?file=../../etc/hostname
Blocked Mutation: WRITE /etc/shadow; UNLINK /var/lib/postgresql/data
Stand Confusion Matrix: TP = 2, FP = 0, TN = 2, FN = 0 (FPR = 0.0%)
Wire Sandbox Rule: SEC-ZD-FS-01
Formal Witness Hash: a17dfc4aef33a97d
Compiled Sentinel Rule: IMMUNE-FS-A17DFC4A (synthesis time 10 µs)3. Automatic Synthesis of Gateway Rule IMMUNE-FS-A17DFC4A
Once witness a17dfc4aef33a97d is sealed in the audit log, the immune compiler outputs contract IMMUNE-FS-A17DFC4A in 10 microseconds. The rule rejects dot-dot segments, encoded path separators, and null-byte suffixes at the gateway boundary.
4. Related Benchmark Classes on the INDRA Stand
INJ-SQL: Database Query InjectionINJ-CMD: Operating System Command InjectionAUTH-BOLA: Broken Object Level AuthorizationSSRF-INT: Server-Side Request Forgery and Redirect BypassSEC-LEAK: Authentication Token and Secret ExposureHDR-SEC: Missing Transport and Framing Security HeadersDOS-RSRC: Computational Resource Exhaustion (Isolated Lab Mode)