Is it possible to exploit a file upload with whitelist and filename hashing?

Question

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I hash the filenames with md5 so e.g. when the user uploads the file exploit.php.jpg it is renamed to 526a8f9f3497b5a69bc4523ba0c6aacd.jpg.

There is neither a MIME-Type verification nor a getimagesize() or resize-function, if it is a picture. Because of that it is possible to upload a php-file that is just renamed to exploit.jpg

Although this seems to be very risky and the user also knows, where this file exists on my server (/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg), I am not able to run this file as a .php.

When I try to open /images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg%00 or /images/526a8f9f3497b5a69bc4523ba0c6aacd.php and so on.. I only get "file not found" (for .php) or "image can not be displayed" (for jpg, gif).

Does anyone know if and how it is possible to exploit that fileupload?

Answer 1

It's possible if you have a LFI in hand. Imagine you have a page like this

http://victimIP&Port/?page=contact.php

http://victimIP&Port/?page=../../../../var/www/payload.jpg <- not found since the filename hash

Then it could be executed like PHP files. In your case

http://victimIP&Port/?page=../../../../var/www/.../images/md5.jpg

You just need to find the LFI vendor for the hashed files.

• https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi-to-rce-via-upload
• https://www.rcesecurity.com/2017/08/from-lfi-to-rce-via-php-sessions/

Answer 2

The file upload vulnerability could be exploited in combination with a local file inclusion bug to attack the server side. Or a malicious file (ie: pdf) could be uploaded to attack an end user with administrative privileges for example.

Your approach seems reasonable enough, however the devil is always in the details and you would need someone with security knowledge to take a look at your source code or running application for a more robust assessment.

Answer 3

Don't trust a whitelist, it can be bypassed:

Content-type: image/jpeg; filename=exploit.php

Hashing the files does not protect you if the attacker can access the file direct:

<img src='http://yoursite.net/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg>

You could create a PHP script to read the file and send the contents to the user, unchanged. This way, the attacker will never reference the file on your server, and whatever server side exploit he could upload would not trigger:

<?php

$filename = getFilenameFromDatabase();
// e.g: $DOCROOT/images/exploit.rb.exe.py.bat.scr.php.jpg
header("Content-type: image/jpeg");
readfile("$filename");
?>

Just make sure to filter the path to the files, otherwise the attacker can get read access of your files.