Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Question

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root.

I have heard from various sources that trusting uploaded files is never safe, because a payload can be uploaded and executed, even if you check the file extension. Ideally, you should check the whole file (which could slow down the system if the uploaded file is a huge video file).

So my question is - is it still unsafe with the following configuration?
You handle the upload with POST requests to a PHP script which checks the file extension and renames the file, then places the file in the subdir "videos". Let's say the subdirectory "videos" is protected like this (nginx):

 location ~ /(videos/|admin-stuff|etc) { deny all; }

When the files are placed in the directory, they have -rw-r--r-- permissions. If I understand correctly, the files cannot be accessed/executed by any means.
Is it still a vulnerability?

Thanks.

Answer 1

You handle the upload with POST requests to a PHP script which checks the file extension and renames the file

You should check the mime type. PHP have mime_content_type function for that. Even if it's possible to fool the mime header and have some code on the metadata of the file, this raises the bar for exploiting your system.

If I understand correctly, the files cannot be accessed/executed by any means.

Not really. They cannot be executed directly by the shell. Nothing stops any attacker to uploading a script named as script.mp4 and somehow executing bash the-new-name.mp4 later.

Or using a local file include (LFI) vulnerability and use include videos/the-new-name.mp4 and running a code on the ID3 description field. You could remove metadata from the files, so even if an attacker sends a video with a shell embedded in metadata and includes it exploiting a LFI, it cannot execute.

Your Nginx settings are good.

Answer 2

Regarding the location in the file system hierarchy, there is no difference between /videos, and /var/www/html/site/videos, or the like. The issue is what permissions, i.e. the executable bit, the directory and files have, (which you mentioned), and also the user to which they are assigned, e.g., www-admin, nginx, etc.

Also, file uploads should be limited to specific file extensions, but you should check the mime-type to ensure they did not simply rename the file. Finally, the files should be scanned by an antivirus software such as ClamAV.