CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities

Summary:

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have released a joint Secure by Design Alert highlighting the significant threat posed by directory traversal vulnerabilities in software. The alert was issued in response to recent attacks that exploited these vulnerabilities, compromising users and impacting critical infrastructure sectors such as healthcare and public health. CISA has identified 55 directory traversal vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the need for software manufacturers to conduct formal testing to identify and mitigate these vulnerabilities. The alert urges executives to ensure their products are secure by design and provides recommended principles and best practices for achieving this goal.