1

I read here http://blog.insicdesigns.com/2009/01/secure-file-upload-in-php-web-applications/ and question is related with text near

However, if the attacker is able to upload files, even outside the web root, and he knows the name and location of the uploaded file, by including his uploaded file he can run arbitrary code on the server.

The solution for that is to prevent the attacker from knowing the name of the file. This can be done by randomly generating file names and keeping track of them in a database.

I fully do not understand security risk. As i understand

  1. attacker uploads malicious file
  2. At the moment my php code converts file name to something random and with that random name stores in particular directory. But the malicious user can see that random name, for example with mouse right click Copy location and see https://domain.com/images/2014-05-16/339442/VH4AGExjRlw=/something_random.jpg. So just creating random name does not help?
  3. As understand in mysql need to record real name of file and the name that user can see in url?

Can not fully understand. Aim is to prevent situation that user uploads file and then knowing file name, can access the file?

  • 1
    The mentioned attack requires a file inclusion vulnerability. – Gumbo Nov 30 '14 at 16:51
2

You are correct. If the ultimate goal is to process the file on the server, then renaming it provides a layer of protection. However, if you are going to redisplay the file, then renaming it hasn't helped; the attacker just uses whatever redisplay mechanism your site provides.

Let us suppose that your web users can upload pictures that are then displayed on the site. As the article in your link says, an attacker can upload a picture that contains PHP (or JavaScript, or whatever) in the embedded comments. If the web server program were somehow (mis)configured to send files with a .jpg extension to the PHP processor, the attacker could run arbitrary PHP code on your machine with the privileges of the web server process.

What this means is that the web developer must carefully sanitize files before allowing them to be redisplayed. So, you'd:

  1. upload to a random file name and keep track of the name
  2. process the file to sanitize it; how to sanitize depends on file type
  3. rename to an "internal" name; you probably don't want to use the uploader's filename anyway because of name collisions.
  4. Place the sanitized file in a directory in or below the web root, or in a database, and set it up for display.

For image files, you can use ImageMagick to strip comments. There is a discussion of using the -SET command to strip comments here: http://www.imagemagick.org/discourse-server/viewtopic.php?t=26106 Interestingly, there is also a link to an image, kitten.jpg, that contains embedded PHP. You might use it to experiment.

Edited 2014-12-02 to add: As Gumbo has pointed out, such an attack can be mounted through a file inclusion vulnerability. In PHP, all included files start in copy mode, so the PHP processor never sees the binary data of the image, it just scans for the XML processing instruction <?php (or any of the other valid introducers.) That switches the PHP processor to interpret mode and the embedded PHP code is executed. When the ?> is encountered, the processor switches back to copy mode and just copies the binary stuff some more.

  • Thanks for answer. But thinking regarding mysql. For example user uploads malicious.jpg. I rename to random.jpg, upload to folder some_folder and record in mysql url some_folder/random.jpg but url to display may be domain.com/mysql_id=12345. What would be difference to compare to url domain.com/some_folder/random.jpg. In both cases malicious user opens random.jpg and if it contains malicious code, the code may be executed. Or there is some difference? – Andris Nov 30 '14 at 16:06
  • Seems the main solution here would be sanitization (before displaying/execution) and not recording in mysql some id for location of particular file.... – Andris Nov 30 '14 at 16:10
  • @user2118559: See point 2. in my answer. You sanitize the file before you store it, and hence before it is ever displayed. – Bob Brown Nov 30 '14 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.