PT066591 (Community Member) asked a question.
Is Directory Traversal valid for windows Dekstop application?
We are creating a .Net core windows desktop application and the application is scanned for any vulnerabilities using Veracode.. There are two flaws reported with Medium vulnerability (Directort Traversal).
We are not sure whether directory traversal flaw is applicable for Windows based application where we don't let the user input any path. Since the directory traversal vulnerabilities are more with http based applications.
Please can somebody advise.
.png){kind=logo}
Hi @PT066591 (Community Member) ,
Yes, Desktop applications can be vulnerable to CWE-73: External Control of File Name or Path. For example here are a few recent examples relating to CWE 73 flaws found in desktop applications:
Having said this, it's more likely that a Desktop application has mitigations in place when accessing files, Veracode Static Analysis may not be able to see these mitigations. You can document these mitigations using the IDE extension or in the Veracode Platform, you can find more documentation on this process here: https://help.veracode.com/r/improve_mitigation .
This will then need to be reviewed by someone from your organization, typically a member of your security team.
If you'd like to review these mitigations I would recommend you schedule a consultation call with a Veracode Application Security Consultant to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema