I'm assessing the security of a webportal for a client and I found a vulnerability.
I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function is directly callable and it doesn't check auth. Anyway, here are the conditions:
Upload takes 2 arguments (lets say), ID (should be int, if its not int, it breaks the code and no upload), file object.
When file is uploaded, it checks for the extension of file using:
pathinfo['extension']
. If extension is one of the followings:
"php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"
it breaks the upload.
Otherwise, it means all checks are passed and it places the file in:
/uploads/$ID.$EXT
P.S. It reads entire POST/GET data (using php://input) if it finds "%00" (uses regex) in the POST/GET/COOKIE/... anything, it breaks the whole connection.
So to summarize, it does 3 checks:
- %00 in POST/GET by reading php://input and searching for %00
- $ID to be int
- Extension of file, shouldn't be equal to
"php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"
It it a vulnerability? Can we bypass the tests and cause damage? RCE?
P.S. It's a Linux server.