3

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I don't have any file upload handling functions can user write and execute malware code into file and execute it?

4
  • 1
    Please clarify the question. Are you talking about processing a file-type <input> on the client (that is, in the web browser), or on the server (after the HTML <form> is submitted)? What kind of processing are you doing with the file? Presumably, if you have a way for the user to input a file, you are doing something with it; what that thing is determines what your security risks are.
    – CBHacking
    Jan 15, 2019 at 22:27
  • @CBHacking Yea, <input type="file" ... I am talking about file upload, but not to the server. But when browser first sees uploaded file. For example can I encode console.log('it worked'); to the file and execute it when uploading to browser? Jan 16, 2019 at 8:40
  • 2
    You don't "upload" anything to a browser. I'm not sure if this is a terminology confusion or something deeper. Processing a file using client side script in a browser is akin to opening a .docx file in Word and calling that "uploading" doesn't make sense, it doesn't travel over any network or to any server. In any case, JavaScript can see the contents of a file input field using the FileReader class, but you have to write script to do that (see stackoverflow.com/questions/5802580/…)
    – CBHacking
    Jan 19, 2019 at 5:53
  • you are essentially submitting a file path to the form... the browser then reads the file and sends it as form data. The server-side will process the file... (it's streamed from the browser to a temp folder if I remember right...) The server-side code will decide what to do with that file. It's particularly important that your server-side code creates the file's filename if storing the file to a folder. (don't rely on the received file's extension or mime-type and use some sort of scheme to create unique filenames) Jun 1, 2020 at 22:44

2 Answers 2

0

For an attacker this is a 2 step process 1 - upload malicious file 2 - execute it

So if they already have an input=file opportunity to get the file onto the system then it's all about step 2.

The attacker has multiple options such as - RCE (remote code execution) vulnerability, they then execute it themself - Social Engineer or wait for a user on the system to execute it (for example if they're uploading a resume , they wait for the HR staff to open it) - If it's a web server , they upload a webshell, then make a web request through a browser to that newly uploaded page/shell ... causing the web server itself to execute it

1
  • "causing the web server itself to execute it" - this is why filesystem = URL tree is such a bad idea Jun 6, 2019 at 4:41
0

Blind - Cross Site Scripting (XSS) can be performed as per my guess. Due to unclear scenario I assume we are uploading a file but cannot execute it. So to exploit it back-end dashboard must be vulnerable to XSS. A file containing malicious JavaScript code in it can be uploaded to the server. For an example a SVG file containig following JS

<svg><desc><![CDATA[</desc><script>alert("document.cookie")</script>]]></svg>

After successful upload whenever the file is visited/opened from back-end side it may executes and gives response to us. Instead of alert message we can include our XSS hunter payload in src=

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .