Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a module in which the user can upload images.
I searched Google for different kinds of upload attacks

  • checking dimension of the image (still vulnerable)
  • checking of file extension mypicture.php%00.jpg (still vulnerable)
  • checking of mime type (still vulnerable)
    The only solution that I have is to change the file name of uploaded file
    e.g:
    fileUploaded:mypicture.jpg
    move_uploaded_file($_FILES["pictures"]["tmp_name"] , 'mycustomname'.'jpg');

My question is:
Is there still a way to upload shell file after I've taken these precautions?

share|improve this question
add comment

1 Answer

You need to do a few more things:

  • Check the file size of the image and enforce a limit (prevent overflows from happening)
  • Along with renaming the file (and storing it with a different name and path than the uploader can recover, preferably on a separate domain), you should also rewrite the file in some minor way (add a bit of random noise) with a tool like ImageMagick.
  • Extract EXIF (and any other similar meta-data) from the file, or just consider converting every image to a bitmap.

Most important -- understand how the executable image exploits work:

http://www.stumbleupon.com/su/1q3iyy/video.google.com/videoplay?docid=4221457095668033104

share|improve this answer
    
thanks for your response thanks for the suggestion i will apply it to my module thanks –  Efaz AÑecoh J-ra Nov 6 '12 at 5:35
2  
Note that renaming uploaded files will prevent them from being executed on your server, it won't prevent a malicious user from using your server to host malicious files for other purposes. –  tylerl Nov 6 '12 at 5:59
2  
A common method is to rename it to the SHA1 hash of the file. This ensures unique naming, and saves you space when duplicates are uploaded. –  Polynomial Nov 6 '12 at 7:04
1  
@Polynomial If you go that way, at I'd prefer a hash function for which collisions are infeasible. Which excludes SHA-1 and MD5. | Some people consider the ability to retrieve a file for which you know the hash a vulnerability, but I don't agree with them. If you want to avoid this, use some kind of keyed hash. –  CodesInChaos Nov 6 '12 at 8:07
    
Since when were SHA1 collisions feasible? –  Polynomial Nov 6 '12 at 8:30
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.