PHP File Upload Vulnerability

Question

I'm assessing the security of a webportal for a client and I found a vulnerability.

I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function is directly callable and it doesn't check auth. Anyway, here are the conditions:

Upload takes 2 arguments (lets say), ID (should be int, if its not int, it breaks the code and no upload), file object.

When file is uploaded, it checks for the extension of file using: pathinfo['extension']. If extension is one of the followings: "php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

it breaks the upload.

Otherwise, it means all checks are passed and it places the file in: /uploads/$ID.$EXT

P.S. It reads entire POST/GET data (using php://input) if it finds "%00" (uses regex) in the POST/GET/COOKIE/... anything, it breaks the whole connection.

So to summarize, it does 3 checks:

• %00 in POST/GET by reading php://input and searching for %00
• $ID to be int
• Extension of file, shouldn't be equal to "php, php3, php4, phps, php5, php6, phtml, html, htm, py, pl, sh"

It it a vulnerability? Can we bypass the tests and cause damage? RCE?

P.S. It's a Linux server.

Answer 1

I'm not sure what the value in their searching for %00 is. (I mean, I guess truncating filenames on really old versions on PHP?)

If the webserver is configured to send all requests to PHP, you can use alternate extensions (.html) and try to get code execution that way. If they've carefully configured to only allow PHP execution for the file extensions they are filtering, I would consider whether any other scripting languages are installed. (e.g., mod_python)

Regardless of RCE on the server, if they're allowing HTML content to be uploaded on the same origin that they host the site, you almost certainly have an XSS vector...

Answer 2

I've managed to gain RCE on a similiar setup uploading a PHP file with the .pht, .phtm, .phar and probably other extensions that usually aren't filtered.