Is it possible to perform CSRF attacks on file upload functionality? My application uploads files by sending multipart/form-data POST requests without any random token. Is it possible to prepare a HTML form which will demonstrate this attack on the application?


Yes, you are vulnerable. Every endpoint that modifies the state of your server needs to have protection against CSRF attacks. File uploads are not excluded.

So how can this be exploited? If your site is example.com the attacker host some JS like this on a site that she tricks the victim into visiting:

myFormData = new FormData();
myFormData.append("file", fileContent, "filename.txt");
fetch("http://example.com/fileupload.php", {
    method: "post",
    body: myFormData,
    credentials: "include"

This will make the victims browser send a POST request to your site, with whatever the attacker chooses as fileContent as the file.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.