File uploads pose a significant risk. OWASP lists the following risks regarding file uploading:
- The impact of this vulnerability is high, supposed code can be executed in the server context or on the client side. The likelihood of detection for the attacker is high. The prevalence is common. As a result the severity of this type of vulnerability is high.
- It is important to check a file upload module’s access controls to examine the risks properly.
- Server-side attacks: The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, or exploit the local vulnerabilities, and so forth.
- Client-side attacks: Uploading malicious files can make the website vulnerable to client-side attacks such as XSS or Cross-site Content Hijacking.
- Uploaded files can be abused to exploit other vulnerable sections of an application when a file on the same or a trusted server is needed (can again lead to client-side or server-side attacks)
- Uploaded files might trigger vulnerabilities in broken libraries/applications on the client side (e.g. iPhone MobileSafari LibTIFF Buffer Overflow).
- Uploaded files might trigger vulnerabilities in broken libraries/applications on the server side (e.g. ImageMagick flaw that called ImageTragick!).
- Uploaded files might trigger vulnerabilities in broken real-time monitoring tools (e.g. Symantec antivirus exploit by unpacking a RAR file)
- A malicious file such as a Unix shell script, a windows virus, an Excel file with a dangerous formula, or a reverse shell can be uploaded on the server in order to execute code by an administrator or webmaster later – on the victim’s machine.
- An attacker might be able to put a phishing page into the website or deface the website.
- The file storage server might be abused to host troublesome files including malwares, illegal software, or adult contents. Uploaded files might also contain malwares’ command and control data, violence and harassment messages, or steganographic data that can be used by criminal organisations.
- Uploaded sensitive files might be accessible by unauthorised people.
- File uploaders may disclose internal information such as server internal paths in their error messages.
The extension allow-list in your post is not enough by itself. It is trivial to masquerade a file as a different MIME type for example:
$ echo "text" > /tmp/file.gif
$ file /tmp/file.gif
/tmp/file.gif: ASCII text
$ echo 'GIF89a; text' > /tmp/file.gif
$ file /tmp/file.gif
/tmp/file.gif: GIF image data, version 89a, 29706 x 30821
Even if someone could upload a nefarious file in disguise it doesn't mean they could execute it but it is a foothold that you would want to avoid.
Another thing to think about is using a file upload as a denial of service device. Without file size checks in place someone could maliciously upload a huge image that fills up your drive.
OWASP Unrestricted File Upload
OnSecurity File Upload Checklist