Agent File Transfer Path Traversal and IP-Notation Bypass
This rule flags file upload/download requests in the browser-use agent framework whose destination address looks deliberately malformed: directory traversal sequences, unusual IP notations (like decimal, octal, or hex instead of normal dotted IPv4), or credentials embedded in the transfer URL. These are the exact input shapes that browser-use's 0.12.7 security patches were built to reject.
How the attack works
An attacker crafts a file upload or download request where the filename or host field contains traversal sequences (../, encoded variants, null bytes, drive-letter or tilde escapes) or writes the destination IP in a non-standard form (decimal, hex, octal, short-form, or IPv4-mapped-IPv6) to slip past simple IP block-lists. The request may also carry credentials directly in the URL. The rule inspects the raw request payload — the url= and host= fields — before any framework-level normalization happens, catching these patterns as they appear on the wire.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3f1c2e-9a4d-4f61-b8e2-5c0d7a1e9f34
- Severity
- High
Why it matters
This is a single-event signal that a file transfer target was deliberately obfuscated or malformed, which typically precedes attempts to write files outside intended directories, bypass network restrictions, or leak credentials in transit. It does not prove the traversal or bypass actually succeeded — the tool cannot see the final resolved destination — so it should be treated as evidence of a hostile attempt, not confirmed compromise.
What you can do
- →Upgrade or patch browser-use past the 0.12.7 vulnerability cluster if you have not already.
- →Restrict the file system paths and network destinations the agent can read from or write to, independent of application-level filtering.
- →Review flagged transfers manually before assuming compromise — legitimate use of internal shorthand IPs or query parameters naming file paths can trigger this signal.
- →Avoid relying on IP block-lists alone for network egress control; enforce restrictions at the network layer using canonical address parsing.
Known benign look-alikes
- Security research or dotfile repositories where the downloaded object key itself is a query-parameter value naming a host path (e.g. an API call with "?path=/etc/passwd" against a documentation or payload-list service). The 32-character adjacency bound reduces but does not eliminate this.
- CDN or scraped-page URLs that were never normalised by the HTTP client and still contain a literal "../" segment from a relative href.
- Legitimate transfers to a bare IPv4 short form on an internal lab host (e.g. host=10.5 style shorthand typed by an operator), which is syntactically indistinguishable from block-list evasion.
- Upload APIs that accept a Windows-style backslash path from a Windows agent ('?filename=\\subdir\\file.docx'), which is malformed but usually benign.
- An object legitimately named with a leading tilde-slash or a single-letter drive prefix in a destination parameter.
- Query strings that carry a 'password=' or 'client_secret=' parameter as part of a legacy provider authentication flow; this is still a credential-in-URL hygiene finding and is reported deliberately.