Upload a file into directory with public write access

Question

I know it is not right to set a permission for the folder as 777, but if it is done so will it be possible to upload a file into that directory without ftp access ? Here is what I mean

Lets say the directory listing is not disabled from apache config, and I can access the folder by ip from the browser, like (im trying from my Win PC connecting to linux in vmware)

http://192.168.252.138/test/public

and lets assume this public folder has 777 permission. Can I somehow(using php or anything else) create file test.php in that folder. I tried smth like (running this from localhost of the Windows)

file_put_contents('http://192.168.252.138/test/public/test.php', 'test file')

but I get warning

failed to open stream: HTTP wrapper does not support writeable connections in

I do not know if this is even possible. And if these is not, then what harm possible attacker can do if I have a directory like that with public write access. considering that there is no ftp access.

Thanks

Answer 1

So there are three scenarios I've seen this pitfall in real life:

1. Insecure WebDAV configuration. WebDAV allows your server to respond to HTTP requests like "PUT /foo/bar/public" by receiving files. If WebDAV uploads are world accessible, you're hosed.

2. Insecure file upload capabilities. If they can redirect the folder it places files in, you're pwned. Or, alternately if you just let people upload random files, you're... special. Very special.

3. Command injection. If attackers can get access to a command line, you've just given them a handy place to put all their malware in your webroot without needing root or fiddling with permissions.

777 is an AWFUL idea. It's like leaving the door to your house open. chmod 605 (-rw----r-x) is an okay default permission for web stuff. Just be careful about the +x; use it sparingly. While 777 itself doesn't create exploits, it makes existing ones very, very deadly. Don't give your attackers any opportunities.