all 20 comments

sorted by: hot top controversial new old
[–] 104 points 2 months ago (13 children)

It's called a Path Traversal attack.

Basically, if you add a ../ in a query, you can start to work backwards in the directory tree to root, then go up again to someplace you shouldn't go. The firewall doesn't block this attack, cause it's just doing a regular HTTP(s) request.

https://owasp.org/www-community/attacks/Path_Traversal

  • source
  • hideshow 13 child comments
  • [–] 35 points 2 months ago (12 children)

    How would a firewall be related to this? A firewall would block/allow the ports 80/443 from certain sources. That’s it. Whatever is happening here it’s related to OS permissions and web server configuration.

  • source
  • parent
  • hideshow 12 child comments
  • Because enterpise firewalls suck ass. If you follow some security researchers on fedi it is shockingly common. Like every week there is an unauth RCE to these things and usually its ../. Is it absurd that a companies expensive first line defense is less secure than your mum's laptop? I'm sure it is "AI" ready though!

  • source
  • parent
  • [–] 11 points 2 months ago (4 children)

    Frankly to suggest that an enterprise firewall would be susceptible to a simple path traversal attack is insane. Unless there's the most embarrassing news story of the decade im missing? That kind of input validation is baked into basically everything these days.

    Maybe you'll land input validation using quadruple URL encoded '../' or something but even still I'd doubt that.

    So the person who replied to you is 100% correct in what it's about, but it doesn't really explain the comic. Unless it was made in like a decade ago.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 10 points 2 months ago (2 children)

    It's pretty common in a killchain following a server side request forgery since the traffic isn't seem by the WAF.

    Example: https://github.com/watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 months ago (1 child)

    It really is not common in the common era.

    E-business suite is not a firewall. Anyone that was using it as one when this cve hit about a year ago wouldnt have qualified as "enterprise" to any required insurance, even then.

    Anyone who was using it as such was/is drowning in so much tech debt that, like, if you work there, leave. Yesterday.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 2 months ago (2 children)

    Layer 7 firewalls are a thing

  • source
  • parent
  • hideshow 2 child comments
  • [–] 44 points 2 months ago (1 child)

    MOOPSY!!!

    That's all you need to know ...

  • source
  • hideshow 1 child comment
  • [–] 41 points 2 months ago* (2 children)

    That is a moopsy.

    It drinks bones.

    The thing cowering and having it's bones drunk is a Pyrithean swamp gobbler. Don't worry about them, they only gobble you.

    It's the moopsy you have to watch out for.

    Oh, you mean the programming type humor superimposed? No idea.

  • source
  • hideshow 2 child comments
  • [–] 2 points 2 months ago (1 child)

    Thanks, I needed that clarification. But I'm still not super sure what I'm looking at... is the skin in the second panel supposed to belong to the huge dragon in the first panel? It doesn't make sense. Presumably there's a huge body attached to that head, the shapes just don't make sense.

  • source
  • parent
  • hideshow 1 child comment
  • Correct.

    The moopsy has drunk the swamp gobbler's bones, and now with nothing to support the squishy insides, the flesh bag drops and it's unable to move.

    Presumably they die when their bones are drunk, otherwise it's a painful few minutes or hours as your system shuts down from not having the skeletal support for organs and stuff.

    It's from a TV show called Star Trek: Lower Decks as the "oh no scary monster is chasing us" plot, and it's cuteness compared to the swamp gobble is just supposed to be funny. In order to demonstrate it's actually the real monster the fovvler cowers away from it before the moopsy jumps on it and basically it deflates like a balloon.

  • source
  • parent
  • [–] 19 points 2 months ago* (last edited 2 months ago)

    There's other good posts here about path traversal recently but I don't think anyone has touched on...this (paths matter) has been happening for decades.

    Story time. In the early aughts (year 2000 πŸ‘΄ ) Microsoft IIS had a bug due to backwards compatibility with MSDOS πŸ’Ύ . The effect was you could find an, ummm, open FTP server, create a LPT1 or COM1 directory, then a subdirectory and this path would be invisible to the system admin. If you knew the path, you could ummm store things in it such as the latest movie, game, etc. Arrgh πŸ΄β€β˜ οΈ

    /edit Ooops, forgot this is a Linux community. Some terms:

    IIS - Microsoft's server. It had a bunch of things in one package; web server, file server, email server, etc.

    MSDOS - Oldass Microsoft operating system. I forget if its the first one. Only supports 8.3 filenames (8 characters plus 3 for file extension).

    FTP - File transfer protocol. We were sending bits over the wire without encryption, YOLO

    LPT1/COM1 - special devices in MSDOS, printer port and serial port

  • source