Pentesting my Own Server File Upload

Question

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can access them via a direct server link, and at the moment I have disabled all server-side/dangerous scripts from being uploaded (php(php3,php4,php5, etc) perl, net, asp, htaccess files, etc) but I still allow images, exe's, and html files to be uploaded.

I only disabled the extensions from being uploaded but so far I have not found anything vulnerable by doing this. Does this cover possible File Upload attacks?

Answer 1

You're using PHP? There are a couple of things to keep in mind. I wrote this article earlier this year which covers file uploads and other topics. Creative Commons so feel free to save a copy, modify, and share as you'd like: https://keenot.es/read/thwarting-basic-web-application-attacks

"Encrypt your files, store them in a random filename in a specific non-webroot directory, and use a database to keep track of their metadata (type, filename, size). Use a script to deliver them from the filesystem, and use header() calls and rewrite directives to trick browsers into treating them like images. Cache heavily to prevent resource exhaustion."

You don't necessarily need to encrypt them; gzip compressing them or base64 encoding them will prevent execution in case they manage to directly access the file. I do recommend abstracting the filename that people see away from what is actually present on the filesystem. While this might be objected by people as a form of "security through obscurity", but if you store everything as a .txt file, nothing will ever execute through accessing an uploaded file.

One very important thing: Don't rely on the file extension or the user-provided $_FILES['abc']['type'] value. They can be spoofed.

Answer 2

Some basic points I keep in mind in such situation are:

• define a .htaccess file and specify which all formats are allowed in it. Don't put .htaccess file in the same directory as the uploaded files will be.

• Specify in .htaccess file, extensions which are allowed. Use some regex to prevent double extension attack.

• Upload files in place other than servers root.

• Do not allow overwriting existing files in the upload directory.
• Create a list of allowed mime-types.
• Don’t rely on client-side validation only, since it is not enough. Ideally one should have both server-side and client-side validation implemented.

P.S: I have taken these from couple of sites and I don't have their links now. These tips were in my personal notes. Sorry for not giving due credit.

Answer 3

Do they upload to their own separate domains? If not your system may be vulnerable to XSS.

Also make sure you've addressed all the points raised here: https://www.owasp.org/index.php/Unrestricted_File_Upload