asp.net - Is the security attack through query string is a CSRF attack? How to prevent attack from query string? -

someone trying access our server page invalid query string throws exception.

query string =./../../../../../../../../../windows/system32md.exe

exception:

could not find file 'c:\windows\system32md.ex'. how prevent these types of attack.

this not csrf attack. may or may not have 1 of - can't say.

it's directory traversal attack.

we creating path guid : server.mappath("~\folder\" + guid)

then path can end outside ~\folder root including 'go-up-a-directory' strings (..) in guid variable. may able access file on server's filesystem - not thing.

before using user input in filename, need check in limited format expect. directory traversal attacks, there other odd things can windows filenames (like reserved names, invalid names, accidental unc paths, unsupported unicode characters etc), should use strict whitelist validation ensure names expect.

for real guid, you'd want validation against regex:

[0-9a-fa-f]{8}-[0-9a-fa-f]{4}-[0-9a-fa-f]{4}-[0-9a-fa-f]{4}-[0-9a-fa-f]{12} 

or if you've got .net 4.5 can use guid.tryparse.

also: if actively trying exploit this, , it's not in company doing approved security testing, you've got problems , should investigating attacks coming from.