{"id":664,"date":"2016-06-24T10:15:44","date_gmt":"2016-06-24T08:15:44","guid":{"rendered":"https:\/\/blog.mi.hdm-stuttgart.de\/?p=664"},"modified":"2023-06-07T11:46:24","modified_gmt":"2023-06-07T09:46:24","slug":"web-app-file-upload-vulnerabilities","status":"publish","type":"post","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2016\/06\/24\/web-app-file-upload-vulnerabilities\/","title":{"rendered":"Web App \u2013 File Upload Vulnerabilities"},"content":{"rendered":"
Today we will discuss file upload vulnerabilities; a topic that is widely underestimated by developers. First, we will imagine a website in which it is possible to upload images with the format .jpg, .png, .gif and so on. If<\/span> an application <\/span>does not have<\/span> proper form validation for file uploads, an attacker is able to gain control over the system.<\/span> This is especially true for file extensions like .php and .asp, since these are automatically interpreted by webservers. I\u2019ll elaborate on how this works, and on which defense strategy will be effective depending on each specific case.<\/div>\n

<\/p>\n

File upload vulnerabilities are a devastating category of web application vulnerabilities. Without secure coding and configuration an attacker can quickly compromise an affected system.<\/p><\/blockquote>\n

The quotation from Matt Koch in 2015 highlights the importance of file upload vulnerabilities in these days. File upload vulnerabilities have been identified in a study of 1600 WordPress pages as third most common vulnerability. As of January 2016th.<\/p>\n

In the simplest case, there are no restrictions on the type of the file, therefore an attacker can easily upload malicious code. This looks naive, but is still common.<\/p>\n

HOW HTTP FILE UPLOAD WORKS<\/strong><\/p>\n

<!DOCTYPE html>\n<html>\n    <body>\n        <form action=\"upload.php\" method=\"post\" enctype=\"multipart\/form-data\">\n            Select image to upload:\n            <input type=\"file\" name=\"uploadedfile\" id=\"uploadedfile\">\n            <input type=\"submit\" value=\"Upload Image\" name=\"submit\">\n        <\/form>\n    <\/body>\n<\/html><\/pre>\n
Above<\/span> is a simple HTML code for an HTTP file upload in which the encryption type specifies the method of encoding.<\/span> If this is set multipart, no character is encoded, but the user agent is adding some information to the request body or payload.<\/p>\n
Getting a POST request with the encoding type multipart \/ form-data<\/code> PHP first generates a temporary file with a random name in a temporary directory (example: \/var\/tmp\/php6yXOVs<\/code>).<\/p>\n
Next up a gloable $_FILES array for the file is created that contains information about the uploaded files:<\/p>\n
<?php \n    $_FILES['uploadedfile']['name']     \n    $_FILES['uploadedfile']['type'] \n    $_FILES['uploadedfile']['size']     \n    $_FILES['uploadedfile']['tmp_name']\n?><\/pre>\n