Timeline for Is it possible to exploit a file upload with whitelist and filename hashing?
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 19, 2022 at 15:13 | comment | added | Margaret Bloom |
It seems fine to me. Assuming the presence of an LFI is a circular argument: will this make my site vulnerable assuming it is already? You can use some defense in depth though: mark /images/ to be served statically (i.e. don't invoke the PHP interpreter at all for this directory) and see if you can run (or demote) the PHP interpreter under a different user in the same group as the web-server user. Then once uploaded assign the image to the web-server user with 620 permissions (assuming the image only needs to be served).
|
|
| S Sep 19, 2022 at 13:31 | history | suggested | UndercoverDog | CC BY-SA 4.0 |
Fixed Highlighting
|
| Sep 19, 2022 at 4:58 | review | Suggested edits | |||
| S Sep 19, 2022 at 13:31 | |||||
| Jul 16, 2021 at 1:32 | comment | added | Slartibartfast | What happens after the files are uploaded? Are they made available (served to the user) via your app at all? (upload malicious file, use your site as a host). Are they processed in some way? (you would need to make sure the software used to process the files is fully robust also, or a vuln. in it could be exploited). Filtering and processing based on filename (metadata) is likely insufficient (IMHO). | |
| Jul 16, 2021 at 0:07 | comment | added | wireghoul |
In a vacuum with the correct web server config, this seem sound. I will assume that your file validation code isn't flawed. However it may be possible to chain attacks as stated in other answers, local file include bugs or hosting an indirect attack like a zipped virus, cross site scripting or phishing page may still be possible and can attack users of the website. While your design seems ok, implementation flaws could still lead to code execution. I have seen fileupload validation that calls /usr/bin/file uploadfilename for mimetypes and would lead to command injection
|
|
| Feb 21, 2021 at 7:30 | answer | added | Alvin Smith | timeline score: 2 | |
| Jan 28, 2015 at 5:02 | answer | added | wireghoul | timeline score: 1 | |
| Nov 18, 2014 at 21:52 | comment | added | zarathustra | @KDEx there is no python or ruby interpreter installed. When I try to open these files, my browser only offers to download these files | |
| Nov 18, 2014 at 19:12 | answer | added | ThoriumBR | timeline score: 0 | |
| Nov 18, 2014 at 18:44 | comment | added | Jeroen | Have a look at how you can determine the file header: it.php.net/manual/en/function.finfo-file.php | |
| Nov 18, 2014 at 18:34 | comment | added | Jeroen | Have you considered null byte injections? Meaning upload a file called exploit.php%00.jpg? Personally I think you should read the first bytes of the file in order to determine the file header. File extension checking by itself is not sufficient enough in my humble opinion. | |
| Nov 18, 2014 at 17:35 | comment | added | KDEx | py and rb? Do you have an interpreter that would execute these files? | |
| Nov 18, 2014 at 17:12 | review | First posts | |||
| Nov 18, 2014 at 17:42 | |||||
| Nov 18, 2014 at 17:05 | history | asked | zarathustra | CC BY-SA 3.0 |