Unrestricted File Upload - Revision history

Svieg: regex was not working properly, now should

2018-07-23T17:50:45Z

regex was not working properly, now should

Svieg: /* Beating getimagesize() */

2018-07-18T15:35:24Z

‎Beating getimagesize()

DhirajMishra: /* File Upload vulnerability */

2017-06-18T09:30:29Z

‎File Upload vulnerability

Soroush Dalili at 15:52, 1 November 2016

2016-11-01T15:52:31Z

Soroush Dalili: Updating the materials to include more test cases / recommendations / references

2016-11-01T15:48:34Z

Updating the materials to include more test cases / recommendations / references

Show changes

Landon Mayo: /* Authors */

2015-05-14T10:09:20Z

‎Authors

Landon Mayo: /* References */

2015-05-14T10:08:43Z

‎References

Bill Sempf: Removed link to inactive ADSR vulns

2014-08-14T20:53:00Z

Removed link to inactive ADSR vulns

Bill Sempf: Moved Author list to the bottom to fit with standards.

2014-08-14T20:52:32Z

Moved Author list to the bottom to fit with standards.

Christina Schelin at 15:53, 4 February 2014

2014-02-04T15:53:14Z

@@ Line 80: / Line 80: @@
 Insecure Configuration :
-   <FilesMatch ".+\.ph(p[3457s]?|t|tml|\-s)">
+   <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)">
    SetHandler application/x-httpd-php
    </FileMatch>
@@ Line 86: / Line 86: @@
 Secure Configuration :
-   <FilesMatch ".+\.ph(p[3457s]?|t|tml|\-s)$">
+   <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)$">
    SetHandler application/x-httpd-php
    </FileMatch>

@@ Line 80: / Line 80: @@
 Insecure Configuration :
-   <FilesMatch ".+\.ph(p[345]?|t|tml)">
+   <FilesMatch ".+\.ph(p[3457s]?|t|tml|\-s)">
    SetHandler application/x-httpd-php
    </FileMatch>
@@ Line 86: / Line 86: @@
 Secure Configuration :
-   <FilesMatch ".+\.ph(p[345]?|t|tml)$">
+   <FilesMatch ".+\.ph(p[3457s]?|t|tml|\-s)$">
    SetHandler application/x-httpd-php
    </FileMatch>

@@ Line 73: / Line 73: @@
 * Flaws in the uploaded file usage for instance when a PHP application uses the "include" function to show the uploaded images.
 * Combination of the above techniques.
 === Whitelisting File Extensions ===

← Older revision		Revision as of 15:52, 1 November 2016
Line 51:		Line 51:


−	== Weak ~~Protection Methods~~ and Methods ~~of Bypassing~~ ==	+	== Weak Protections and Bypassing Methods ==

	=== Blacklisting File Extensions ===		=== Blacklisting File Extensions ===

@@ Line 168: / Line 168: @@
 *[[User:Soroush Dalili|Soroush Dalili]]
 *[[User:Dirk Wetter|Dirk Wetter]]
 *[[User:OWASP|OWASP]]

@@ Line 144: / Line 144: @@
 *Improve File Uploaders’ Protections – Bypass Methods- Rev. 1.0 http://soroush.secproject.com/blog/2010/03/improve-file-uploaders%e2%80%99-protections-rev-1-0/
 *IIS6/ASP & file upload for fun and profit http://blog.48bits.com/2010/09/28/iis6-asp-file-upload-for-fun-and-profit/
 *Secure file upload in PHP web applications http://www.net-security.org/dl/articles/php-file-upload.pdf

← Older revision		Revision as of 20:53, 14 August 2014
Line 3:		Line 3:
	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''		Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

−	~~[[ASDR TOC Vulnerabilities\|Vulnerabilities Table of Contents]]~~

	== Description ==		== Description ==

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
@@ Line 169: / Line 164: @@
 *CVE-2009-4445 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4445
 *CVE-2009-1535 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1535
 __NOTOC__

@@ Line 12: / Line 12: @@
 == Description  ==
 Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. Using a file upload helps the attacker accomplish the first step.
-The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to backend systems, and simple defacement. It depends on what the application does with the uploaded file and especially where it is stored.
+The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, and simple defacement. It depends on what the application does with the uploaded file and especially where it is stored.
-There are really two different classes of problems here. The first is with the file metadata, like the path and filename. These are generally provided by the transport, such as HTTP multipart encoding. This data may trick the application into overwriting a critical file or storing the file in a bad location. You must validate the metadata extremely carefully before using it.
+There are really two classes of problems here. The first is with the file metadata, like the path and file name. These are generally provided by the transport, such as HTTP multi-part encoding. This data may trick the application into overwriting a critical file or storing the file in a bad location. You must validate the metadata extremely carefully before using it.
 The other class of problem is with the file size or content. The range of problems here depends entirely on what the file is used for. See the examples below for some ideas about how files might be misused. To protect against this type of attack, you should analyze everything your application does with files and think carefully about what processing and interpreters are involved.
-== Risk Factors  ==
+* The impact of this vulnerability is high, supposed code can be executed in the server context or on the client. The likelihood of a detection for the attacker is high. The prevalence is common. As a result the severity of this type of vulnerability is High.
+* The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth. This may also result in a defacement.
-*The impact of this vulnerability is high, supposed code can be executed in the server context or on the client. The likelihood of a detection for the attacker is high. The prevalence is common. As a result the severity of this type of vulnerability is High.
+* An attacker might be able to put a phishing page into the website.
-*The web server can be compromised by uploading and executing a web-shell which can: run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so on. This may also result in a defacement.
+* An attacker might be able to put stored XSS into the website.
-*An attacker might be able to put a phishing page into the website.
+<!-- *Local file inclusion vulnerabilities can be exploited by uploading a malicious file into the server. -->
-*An attacker might be able to put a stored XSS into the website/
+* This vulnerability can make the website vulnerable to some other types of attacks such as [[Cross-site Scripting (XSS)|XSS]].
-<!--
+* Picture uploads may trigger vulnerabilities in broken picture libraries on a client (libtiff, IE had problems in the past) if the picture is published 1:1.
-*Local file inclusion vulnerabilities can be exploited by uploading a malicious file into the server.
+* Script code or other code may be embedded in the uploaded file, which gets executed if the picture is published 1:1.
--->
+* Local vulnerabilities of real-time monitoring tools, such as an antivirus, can be exploited.
-*This vulnerability can make the website vulnerable to some other types of attacks such as [[Cross-site Scripting (XSS)|XSS]].
+* A malicious file (Unix shell script, windows virus, reverse shell) can be uploaded on the server in order to execute code by an administrator or webmaster later -- on the server or on a client of the admin or webmaster.
-* Pictures may trigger vulnerabilities in broken picture libraries on a client (libtiff, IE had problems in the past) if picture is published 1:1
+* The web server might be used as a server in order to host of malware, illegal software, porn, and other objects.
 == Examples  ==