Sorry, to clarify... the web app is written in PHP but after it achieves its purpose I turn off the app. Once the PHP script is exited I still get traversal vulnerabilities. I personally wouldn't know how to find the application running on those ports, it is also possible the security tool is accessing that port. How can I fix this at code level? I read some items mentioning filtering basepaths? I was just hoping someone with more background on this could provide an example or even a basic solution at code level ideally.

@SChand, if that's the case, then it's definitely not in your PHP code.

@Ghedipunk where would this code based traversal security go? what language is code like this written in? The goal of the question is to fix the traversal vulnerability

@SChand, it's in the dwcore application installed on your RPi. So far, nobody knows what that is beyond its name. Maybe someone will come by with a better idea, but right now, you're the one with the most access to information on it, since you're the one with that application. If you want to stop that vulnerability, your options are to investigate further (we're unlikely to be able to help you with that), or remove that program and see what happens. (Be aware that bad things might happen if you remove that program. Until someone learns what dwcore is, we can't give you good advice.)

Do I need to know the application? Isn't it possible to detect attacks on those ports without caring about the device/application attached to it?

@SChand ports aren't open by default. They're only "open" when an application is running and listening for input on them. So yes, you do need to know the application, because it is that application that is processing the input and doing something with it. Also, I suspect that ports 4011 and 4012 are equally vulnerable but because they're non-standard ports your security software didn't try them.

@drewbenn thanks for that clarification. Let's say I don't care which application is using the port and it is an attack. How would I go about handling this? Currently reading about IPTABLES (know anything on this?).

@SChand a firewall would just prevent anything from using the port. Why wouldn't you just turn off (or fix) the application?

@drewbenn are you saying this application is keeping the ports open and when I run my security scan it uses the port the application opened to attack my system? .... if so, then wouldn't I need to configure the Raspberry Pi to only allow devices on those ports a minimal level of access?... Also, is it possible the router I'm connected to is using the ports?

Yes, I'm saying exactly that. But no, you need to fix that application so it will not allow directory traversal. The problem here is not the Raspberry Pi nor is it Linux nor does it have anything to do with the network. The problem is solely within the dwcore application, whatever that is.

sudo kill -9 11025 -- This will stop that process. It might have side effects that nobody here can foresee. It will only stop it until it restarts, which is likely the next time the computer is rebooted, and the next time it restarts, it will have a different process ID, so you'll need to use a different number. It could auto-restart. It might crash your OS (very unlikely, though). Treat this command as a gun that might be pointing at your foot. A better option would be to get a professional to look at it in person.

The point of asking questions is to learn so I can fix this myself or help the community learn something new. Thanks for the quick fix suggestion, I am seeking something more concrete.

@Ghedipunk "dwcore" is deviceWISE M2M by Telit just adding some more info in case that helps

@SChand What have you installed on this RaspberryPi?

We cannot provide a solution at code level because we don't know what dwcore is and we cannot see the code of dwcore which resulted path traversal vulnerability. Is dwcore some third party app you installed after you started your Pi? Or is it the process of your own PHP application?

@hax dwcore is linked to Telit and I used Telit device for my Cellular modem... (the results you see above are from a unit that no longer runs the modem but it seems the SW is still active)

In that case killing that process would resolve your issue. Give it a try with the command Ghedipunk provided in the above comment

That did not work as the Program restarted itself almost immediately.

Then kill what's restarting it. Perhaps you misunderstood stack exchange for a customer support for the product you are using. This extended discussion which is happening right now has nothing to do with the vulnerability you mentioned. The vulnerability is 'directory traversal' and the fix for it is preventing your web application from interpreting relative paths in user input in the context of OS. Neither can anyone here provide you with a 'code which fixes your issue' nor can we pin point the issue with details which we don't have.

@Ghedipunk will do. Thanks all for your help to this point.