File upload vulnerability: rename solution?

Question

I have a module in which the user can upload images.
I searched Google for different kinds of upload attacks

checking dimension of the image (still vulnerable)
checking of file extension mypicture.php%00.jpg (still vulnerable)
checking of mime type (still vulnerable)
The only solution that I have is to change the file name of uploaded file
e.g:
fileUploaded:mypicture.jpg
move_uploaded_file($_FILES["pictures"]["tmp_name"] , 'mycustomname'.'jpg');

My question is:
Is there still a way to upload shell file after I've taken these precautions?

Add a check to alert the administrator if the folder that will receive the images has any execution permission, so that new files stored in that directory do not have it. — DarkLighting, Feb 25, 2016 at 21:59

Charles Boyd · Accepted Answer · 2012-11-06 04:32:37Z

3

You need to do a few more things:

Check the file size of the image and enforce a limit (prevent overflows from happening)
Along with renaming the file (and storing it with a different name and path than the uploader can recover, preferably on a separate domain), you should also rewrite the file in some minor way (add a bit of random noise) with a tool like ImageMagick.
Extract EXIF (and any other similar meta-data) from the file, or just consider converting every image to a bitmap.

Most important -- understand how the executable image exploits work:

answered Nov 6, 2012 at 4:32

Charles Boyd

1885 bronze badges

thanks for your response thanks for the suggestion i will apply it to my module thanks
– Efaz AÑecoh J-ra
Nov 6, 2012 at 5:35
2

Note that renaming uploaded files will prevent them from being executed on your server, it won't prevent a malicious user from using your server to host malicious files for other purposes.
– tylerl
Nov 6, 2012 at 5:59
3

A common method is to rename it to the SHA1 hash of the file. This ensures unique naming, and saves you space when duplicates are uploaded.
– Polynomial
Nov 6, 2012 at 7:04
1

@Polynomial If you go that way, at I'd prefer a hash function for which collisions are infeasible. Which excludes SHA-1 and MD5. | Some people consider the ability to retrieve a file for which you know the hash a vulnerability, but I don't agree with them. If you want to avoid this, use some kind of keyed hash.
– CodesInChaos
Nov 6, 2012 at 8:07
Since when were SHA1 collisions feasible?
– Polynomial
Nov 6, 2012 at 8:30

| Show 3 more comments

1 Answer 1