2

I am administering a mobile application with many users. Users can upload their own .jpg images.

I cannot know at this moment if image inputs on the application I am administrating are sanitized or not, but I know that a user managed to upload an image which crashes application for whoever views the image.

It works like this:

  1. User uploads his .jpg file to his profile

  2. It gets stored in database

I checked the database and saw that instead of the image file name for the user it says simply <HTML></HTML>

I instantly realized that he might have a method to merge HTML/PHP files with image files and execute code.

Being extremely stupid I deleted the actual file he uploaded without checking it first.

Now, is there some way to launch simple php/mysql codes using the image merge method to test the vulnerability myself? I tried variations with adding html and php code in EXIF data of the header, but it still saved as a normal image in the database. I did not manage to get the image saved as < HTML >< / HTML> as the hacker originally did.

It is possible that he couldn't get past the security and actually hack into the server, but it is obvious he launched a script which resulted in an error and the app crashing.

I would like to figure out what kind of a method was used here. Would appreciate any help!

1

One of the most important laws of security: Never ever think about trusting the client. No exceptions.

If your client can send any file for you and have direct access to it later, you are asking for trouble.

If your files are pictures, make sure they are really pictures. Searching for .png on the extension or Content-type: image/png is not enough. You must use functions to really detect a picture.

And you must not let users direct access the files. Get the file, put on a folder inaccessible to the webserver using a generated name, and use a file to send the image to the client, using fpasstrhu() or something like it. If possible, apply some transformation to the image.

Does not matter if it's a mobile application, a desktop application, an API or anything: the server is the same.

0

If you didnt sanitize your file input AT ALL, the hacker might just uploaded a php shell like c99.php to your server. He could then access the shell control via yourapp.com/uploads/c99.php

If you checked the content type of the request, he might uploaded the shell after changing the content type of the request to image/jpg through a HTTP POST editing tool.

And if you checked the file extension, he probably uploaded the c99.php shell as c99.jpg and changed the file extension to .php through a HTTP POST editing tool.

By the way, this php shell i talked about take full control of your server, leading to data leaks and defacement.

I searched the php.net documentation about secure file uploads, and the most secure way to sanitize file input data is to use the finfo extension.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.