I was reading this article about file upload vulnerability: https://www.owasp.org/index.php/Unrestricted_File_Upload

I saw this statement:

Finding characters that are converted to other useful characters during the file upload process. For instance, when running PHP on IIS, the ">", "<", and double quote " characters respectively convert to "?", "*", and "." characters that can be used to replace existing files (e.g. "web<<" can replace the "web.config" file). In order to include the double quote character in the filename in a normal file upload request, the filename in the "Content-Disposition" header should use single quotes (e.g. filename='web"config' to replace the "web.config" file).

  1. Can anyone explain it to me with an example? how "web<<" will replace "web.config" and other files?
  2. and the second part about "Content-Disposition"?

1 Answer 1


Can anyone explain...?

Perhaps the developers at Microsoft can explain why they chose to apply globbing in this context. Personally I find it really silly - but sadly not the first time I've seen such counter-intuitive behaviour on Microsoft's platforms.

Note that the quote comes from a section on the owasp page on how NOT to do file uploads. The author is here explaining how to exploit the vulnerability. By default, browsers will use double quotes to delimit - indeed, I believe that the spec inherits from RFC 822 which requires double quotes - so in the absence of an escaping mechanism, you cannot embed double quotes within double quotes. Again, you would need to ask Microsoft why they chose to forge their own path.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .