Timeline for Is it possible to exploit a file upload with whitelist and filename hashing?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 19, 2022 at 15:44 | comment | added | ThoriumBR | There are functions to see if a image is a image, but there are certain kinds of files that may behave on distinct ways depending on who is calling them, they are called polyglots. You can have a jpeg file encapsulating a PHAR file, and that single file will be identified as jpeg by image functions, and executed as PHAR by PHP. | |
| Sep 19, 2022 at 15:09 | comment | added | Margaret Bloom |
Why OP should not trust a white list, assuming the extension validation is correct (php already has a function for this)? What the img is supposed to do besides fetching a public image?
|
|
| Jan 28, 2015 at 4:59 | comment | added | wireghoul | He didn't post the extension validation code so it may still be vulnerable to bypasses. | |
| Jan 17, 2015 at 18:44 | comment | added | v6ak | The whitelist bypass does not apply there. He whitelists the extensions, not MIME types, so your attack will not work. | |
| Nov 19, 2014 at 15:20 | comment | added | zarathustra |
Thank you for your answer. So the only way to use this vulnerability is, when I can manage to include the uploaded file in my php code? I tried <img src='exploit.jpg'> but nothing happend; only a "failed image" symbol is shown.
|
|
| Nov 18, 2014 at 19:12 | history | answered | ThoriumBR | CC BY-SA 3.0 |