Description

This detector identifies path traversal vulnerabilities in Java applications that use multipart file uploads. When filenames from uploaded files are used directly in file system operations without validation, attackers can manipulate the filename to access files outside the intended directory using path traversal sequences like "../".

Detection Strategy

• Checks if the code imports multipart upload libraries (e.g., Apache Commons FileUpload, Spring MultipartFile)

• Identifies file system operations (like file creation, writing, or path construction)

• Verifies that these operations use the original filename from uploaded multipart files as a path argument

• Reports a vulnerability when the original filename from a multipart upload is directly used in file operations without proper sanitization

Vulnerable code example

import java.io.File;
import java.io.IOException;
import java.nio.file.Path;
import java.nio.file.Paths;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestPart;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.multipart.MultipartFile;...

✅ Secure code example

import java.io.File;
import java.io.IOException;
import java.nio.file.Path;
import java.nio.file.Paths;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestPart;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.multipart.MultipartFile;...