Is it possible to execute a php script in an image file? [duplicate]

Question

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image.

I opened all the images that he uploaded to my server with notepad. The last line of one image is:

Àpa@ ;
<?php

echo "test ok";
?>

Can he hack my website using this image? How do I prevent users from uploading images like this?

Answer 1

Image uploads (any files in general) are very hard to make completely secure - especially in PHP, which provides many attack vectors.

If you, for example display the image by calling

require($someImage);

and that image has PHP code inside (like the one you posted), it may be interpreted and executed as such.

My guess is, if he claims he's owned your site, he most probably has. The image you've provided in itself won't do anything except print "test ok", but that code could easily be exchanged for some that gives unauthorized (even completely unrestricted) access to your site and server.

To make sure the file uploaded to your site is in fact an image, re-process it using GD (or Imagick), and save the processed image. It's bad practice to save the original image, especially using the original file name, as this opens up for many other attacks (for example directory traversal and file overwriting).

More information: https://www.owasp.org/index.php/Unrestricted_File_Upload

Answer 2

Yes, your server could run PHP code within an image file if it is not configured correctly:

http://www.phpclasses.org/blog/post/67-PHP-security-exploit-with-GIF-images.html

An example from that is image.gif.php. A file can be be both a valid image and a valid PHP script, it's not sufficient to simply check image size or other properties. Nor is it sufficient to strip metadata, an uncompressed GIF can contain PHP as image data (though it may be unpretty), PNG supports arbitrary data chunks.

The flaw is accepting uploads with insufficient sanity checking, specifically attempting to prevent unwanted filenames (e.g .php) by using a non-anchored regex like \.(png|gif|jpg|jpeg) (no $ anchor), and allowing those images to be served from a directory with PHP processing enabled. Best practise is that you should probably never use a user provided filename as-is.

These are fairly classic data validation and input validation failures.

If you follow the PHP installation instructions (for Apache 2) you'll have something like this in your Apache config:

<FilesMatch "\.ph(p[2-6]?|tml)$">
    SetHandler application/x-httpd-php
</FilesMatch>

Note the $ anchor, it will prevent file.php.gif from being interpreted by PHP. (What's missing from those instructions is making sure that PHP is limited by a <Directory> context containing only trusted code, and not writeable by the web server user.)

If you don't follow those instructions, and use mod_mime's AddType (or AddHandler) instead:

AddType application/x-httpd-php .php      # STOP! 

This can cause the same problem because mod_mime may do something you don't expect with multiple extensions. See http://blog.dynom.nl/archives/Be-careful-with-double-extensions_20081024_25.html (thanks to Hendrik Brummermann for pointing this out). This risk can be mitigated with correctly configured <Directory> context to allow only trusted code.

This document (PDF) is a little old, but it covers the mitigations well: http://www.net-security.org/dl/articles/php-file-upload.pdf

Another possible source of problems is insecure include/require statements (also covered in that PDF) which allow an attacker to include uploaded content by altering query strings or HTTP request headers.

See also the recent related question: Risks of a PHP image upload form (though I do not think it is correct to rely on getimagesize to verify images), and Use PHP to check uploaded image file for malware? (which contains a useful set of links).

Answer 3

I'm going to assume that you're running LAMP (and an answer for other php setups would be very similar).

---

Most likely, his code cannot do anything to your site.

Let's say that Apache is serving files out of /var/www on your server. Say somebody visits index.php on your website.

1. Apache will receive that they are looking for /index.php
2. Apache will look for the file /var/www/index.php

3. If Apache is running mod_php, then it will check if index.php matches a rule in the mod_php configuration file in some way. Your mod_php config file (probably at /etc/apache2/mods-available/php5.conf) is most likely a superset of this minimal example I've created below:

   <IfModule mod_php5.c>
       <FilesMatch ".+\.ph(p[345]?|t|tml)$">
           SetHandler application/x-httpd-php
       </FilesMatch>
   </IfModule>
   

   • If the file name does match, then Apache will run the file through a php interpreter, creating a web page that it will serve that to the user.
   • If the file name does not match, then Apache will just serve that to the user.
   • (These details skip many bits of apache that I don't think are relevant here)

Let's say that a user uploads an image, say evil_image.png, and it has arbitrary PHP code in it.

Let's also say that you serve it to users from somewhere, say at /images/evil_image.png (so within your filesystem, /var/www/images/evil_image.png).

When somebody tries to retrieve this image by accessing your website at /images/evil_image.png, Apache will run through the steps that I outlined above. At step 3, /images/evil_image.png will not match the pattern from your configuration file, so you will not execute the code as php. You will simply serve the image to the user.

The user will receive the image file that has the malicious crafted text stored inside of it. What is important is that your server has not tried to execute the code, rendering it ineffective.

---

I am not saying that it is impossible for that code to be executed. I will tell you that you need to sorely miss configure your web server in order to cause that code to be executed.