Basically, if you add a …/ in a query, you can start to work backwards in the directory tree to root, then go up again to someplace you shouldn’t go. The firewall doesn’t block this attack, cause it’s just doing a regular HTTP(s) request.
How would a firewall be related to this? A firewall would block/allow the ports 80/443 from certain sources. That’s it. Whatever is happening here it’s related to OS permissions and web server configuration.
Because enterpise firewalls suck ass. If you follow some security researchers on fedi it is shockingly common. Like every week there is an unauth RCE to these things and usually its …/. Is it absurd that a companies expensive first line defense is less secure than your mum’s laptop? I’m sure it is “AI” ready though!
Frankly to suggest that an enterprise firewall would be susceptible to a simple path traversal attack is insane. Unless there’s the most embarrassing news story of the decade im missing? That kind of input validation is baked into basically everything these days.
Maybe you’ll land input validation using quadruple URL encoded ‘…/’ or something but even still I’d doubt that.
So the person who replied to you is 100% correct in what it’s about, but it doesn’t really explain the comic. Unless it was made in like a decade ago.
E-business suite is not a firewall. Anyone that was using it as one when this cve hit about a year ago wouldnt have qualified as “enterprise” to any required insurance, even then.
Anyone who was using it as such was/is drowning in so much tech debt that, like, if you work there, leave. Yesterday.
The point of the comic is that people expect a firewall to protect them from attacks, but then the attack comes in as a path traversal and the firewall does nothing.
It’s called a Path Traversal attack.
Basically, if you add a …/ in a query, you can start to work backwards in the directory tree to root, then go up again to someplace you shouldn’t go. The firewall doesn’t block this attack, cause it’s just doing a regular HTTP(s) request.
https://owasp.org/www-community/attacks/Path_Traversal
How would a firewall be related to this? A firewall would block/allow the ports 80/443 from certain sources. That’s it. Whatever is happening here it’s related to OS permissions and web server configuration.
Because enterpise firewalls suck ass. If you follow some security researchers on fedi it is shockingly common. Like every week there is an unauth RCE to these things and usually its …/. Is it absurd that a companies expensive first line defense is less secure than your mum’s laptop? I’m sure it is “AI” ready though!
It’s referring to a Web Application Firewall.
Unlikely.
Frankly to suggest that an enterprise firewall would be susceptible to a simple path traversal attack is insane. Unless there’s the most embarrassing news story of the decade im missing? That kind of input validation is baked into basically everything these days.
Maybe you’ll land input validation using quadruple URL encoded ‘…/’ or something but even still I’d doubt that.
So the person who replied to you is 100% correct in what it’s about, but it doesn’t really explain the comic. Unless it was made in like a decade ago.
See this comment https://feddit.org/comment/14642166 Plus https://www.sentinelone.com/vulnerability-database/cve-2026-34790/ Granted by no means trivial methods
It’s pretty common in a killchain following a server side request forgery since the traffic isn’t seem by the WAF.
Example: https://github.com/watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882
It really is not common in the common era.
E-business suite is not a firewall. Anyone that was using it as one when this cve hit about a year ago wouldnt have qualified as “enterprise” to any required insurance, even then.
Anyone who was using it as such was/is drowning in so much tech debt that, like, if you work there, leave. Yesterday.
The point of the comic is that people expect a firewall to protect them from attacks, but then the attack comes in as a path traversal and the firewall does nothing.
Layer 7 firewalls are a thing
Layer 7 firewall sounds so wrong
That’s why it’s usually called a WAF (Web Application Firewall), although you can also have L7 firewall for non-web applications (SMTP, SQL, whatever)