2

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I don't have any file upload handling functions can user write and execute malware code into file and execute it?

  • Please clarify the question. Are you talking about processing a file-type <input> on the client (that is, in the web browser), or on the server (after the HTML <form> is submitted)? What kind of processing are you doing with the file? Presumably, if you have a way for the user to input a file, you are doing something with it; what that thing is determines what your security risks are. – CBHacking Jan 15 at 22:27
  • @CBHacking Yea, <input type="file" ... I am talking about file upload, but not to the server. But when browser first sees uploaded file. For example can I encode console.log('it worked'); to the file and execute it when uploading to browser? – KoboldMines Jan 16 at 8:40
  • You don't "upload" anything to a browser. I'm not sure if this is a terminology confusion or something deeper. Processing a file using client side script in a browser is akin to opening a .docx file in Word and calling that "uploading" doesn't make sense, it doesn't travel over any network or to any server. In any case, JavaScript can see the contents of a file input field using the FileReader class, but you have to write script to do that (see stackoverflow.com/questions/5802580/…) – CBHacking Jan 19 at 5:53
0

For an attacker this is a 2 step process 1 - upload malicious file 2 - execute it

So if they already have an input=file opportunity to get the file onto the system then it's all about step 2.

The attacker has multiple options such as - RCE (remote code execution) vulnerability, they then execute it themself - Social Engineer or wait for a user on the system to execute it (for example if they're uploading a resume , they wait for the HR staff to open it) - If it's a web server , they upload a webshell, then make a web request through a browser to that newly uploaded page/shell ... causing the web server itself to execute it

  • "causing the web server itself to execute it" - this is why filesystem = URL tree is such a bad idea – John Dvorak Jun 6 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.