File Upload Vulnerabilities
1. Definition
File Upload Vulnerabilities occur when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size.
The most critical impact is Remote Code Execution (RCE): an attacker uploads a script (e.g., shell.php) which is then executed by the server.
2. Technical Explanation
Servers often determine how to handle a file based on its extension or MIME type.
- Extension Bypass: Attackers rename
shell.phptoshell.php.jpgorshell.php%00.jpg(Null Byte). - MIME Spoofing: Changing the
Content-Typeheader toimage/jpegwhile sending a PHP script. - Polyglots: Creating a valid image file that also contains valid PHP code in its metadata (EXIF).
If the server saves this file to a public directory (e.g., /uploads) and the server is configured to execute PHP/ASP files in that directory, visiting site.com/uploads/shell.php executes the malware.
3. Attack Flow (Web Shell)
sequenceDiagram
participant Attacker
participant Server
participant FS as FileSystem
Attacker->>Server: POST /upload (shell.php renamed to shell.jpg)
Note right of Attacker: Content: <?php system($_GET['cmd']); ?>
Server->>Server: Check Extension (.jpg)? Pass.
Server->>FS: Save to /var/www/uploads/shell.jpg
Attacker->>Server: GET /uploads/shell.jpg
Note right of Attacker: Server executes PHP because<br/>config allows .jpg to run as script<br/>OR file was saved as .php
Server-->>Attacker: Result of command execution4. Real-World Case Study: ImageTragick (2016)
Target: Thousands of websites using ImageMagick. Vulnerability Class: File Processing / Command Injection (CVE-2016-3714).
The Vulnerability: ImageMagick is a library used by many sites (including Facebook and Yahoo at the time) to resize user-uploaded photos. It had a flaw in how it handled SVG (Vector) files. It supported “delegates” that could execute shell commands.
The Attack: An attacker uploaded a crafted image file (like exploit.jpg or exploit.mvg) containing:
fill 'url(https://example.com/image.jpg"|ls "-la)'When the server attempted to “resize” this image, ImageMagick executed the ls -la command on the server. This allowed full RCE simply by uploading a profile picture.
5. Detailed Defense Strategies
A. List of Allowed Extensions (Allowlist)
Never use a blocklist (denying .php, .exe). Attackers will find .php5, .phtml, etc.
- Allowlist: Only accept specific safe extensions:
.jpg,.png,.pdf.
B. Validate Content (Magic Bytes)
Do not trust the file extension or the Content-Type header (these are user-controlled).
- Mechanism: Read the first few bytes (Magic Number) of the file.
- JPEG =
FF D8 FF - PNG =
89 50 4E 47
- JPEG =
- Reject the file if the magic bytes do not match the extension.
C. Randomize Filenames
Never use the user-provided filename (my_vacation.jpg).
- Defense: Rename the file to a UUID (
f47ac10b...jpg) upon storage. This prevents overwriting critical system files and mitigates some directory traversal attempts.
D. Store Outside Webroot
Store uploaded files in a directory that is not accessible via the web server (e.g., an S3 bucket or a private folder). Serve them back via a controller that reads the file stream. This prevents the server from ever executing the file.