Questions tagged [file-upload]

File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

Filter by
Sorted by
Tagged with
118
votes
11answers
51k views

Hacker used picture upload to get PHP code into my site

I'm working on a website — right now it's in early stages of testing, not yet launched and just has test data - thank goodness. First of all, a hacker figured out the password to log onto the ...
54
votes
5answers
19k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
45
votes
2answers
35k views

Risks of a PHP image upload form

My client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated with ...
34
votes
5answers
9k views

Does changing an uploaded executable's file extension to .png render it safe?

A colleague of mine has a personal website in which he allows users to upload anything within a certain size, but before the actual upload he checks to see the file extension: if ( $type == 'image/...
32
votes
5answers
15k views

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
29
votes
2answers
23k views

Exploits or other security risks with SVG upload?

I have a site, where people can upload graphics, you might think of it like an image hoster or a forum for pictures. Now, I allow upload of raster graphics to a certain size, but no vector graphics ...
27
votes
8answers
8k views

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
27
votes
3answers
10k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
23
votes
3answers
7k views

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure ...
20
votes
3answers
22k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
20
votes
9answers
17k views

Keep encrypted files in sync on a cloud service, without having to upload an entire encrypted volume each time

Situation: User has several folders worth of GBs which they want to keep in sync on a cloud service (for example Mega or Dropbox) in an encrypted form; User does not want to sync a single encrypted ...
19
votes
4answers
9k views

What are the security threats of zip file uploads and what preventive actions should be taken?

We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are ...
19
votes
4answers
11k views

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and ...
19
votes
4answers
2k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
18
votes
3answers
5k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
17
votes
6answers
15k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ?
17
votes
3answers
6k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
16
votes
3answers
73k views

Exploiting a PHP server with a .jpg file upload

I would like to ask a question regarding the classic uploading an image and executing php code exploit on a website. So I have been trying out this exploit a website I'm supposed to hack (It's set up ...
13
votes
3answers
34k views

How does SFTP function without a manually generated public/private key pair

I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
13
votes
3answers
22k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
12
votes
2answers
5k views

How to prevent XSS in SVG file upload?

Currently assessing an application, I found out that it is possible to submit an SVG file containing JavaScript (the app is also vulnerable to XXE). I wondered if there was a method to prevent those ...
11
votes
2answers
2k views

Why does OWASP suggest using POST over PUT for file uploads?

When browsing the OWASP security recommandations for file uploads, I ticked reading the following : Try to use POST method instead of PUT (or GET!) I don't see how one method is better than ...
10
votes
4answers
5k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
10
votes
5answers
7k views

How insecure is FTP?

Okay, we know the drill: don't use FTP, use SFTP or FTPS. But what exactly is the risk being posed? The files themselves are sent unencrypted, and this may be fine, or disastrous, depending on what ...
10
votes
2answers
7k views

Antivirus for scanning anonymous file uploads

Since I have no experience with AV solutions on Unix-like environments, I would need help with suggestions on something that can be suitable for scanning files that are uploaded by anonymous users ...
10
votes
1answer
10k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
10
votes
1answer
391 views

Security measures and anti-virus on server to mitigate acting as a propagation vector

We have a web application for which I've been asked to add the ability to let users upload documents that will then be visible and downloadable by other users. Those documents will typically be images ...
9
votes
2answers
4k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
9
votes
1answer
7k views

How can I spoof the Mimetype of a file upload?

There are posts that says php mimetype isn't secure, or can be bypassed. How do people spoof the mimetype?
8
votes
3answers
2k views

How to safely allow upload of executable files [duplicate]

I need help regarding file uploading. In one of my projects the client wants to allow a file upload without restrictions on the file type. But I'm afraid that then users can upload executable files ...
8
votes
2answers
18k views

What does it mean to have a “file name with NULL bytes in serialized instances”?

I was browsing this page, which redirected me to this vulnerability because I'm a Java developer and I'm aware of the affected library. Basically the vulnerability says: It was discovered that ...
8
votes
5answers
2k views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
8
votes
2answers
5k views

C# Image.FromStream is that secure?

after reading the data from the request as Stream i needed to convert it to Image so i used this Method: Stream inputStream = HttpContext.Current.Request.InputStream; Image img = Image.FromStream(...
7
votes
6answers
3k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...
7
votes
4answers
14k views

Is it necessary to scan users' file uploads by antivirus?

Web application allows users to upload files. Is it necessary to scan those files by antivirus? I'd want to hear answer in two scenarios: Type of file isn't checked when uploading. They are stored ...
7
votes
2answers
525 views

What are the potential vulnerabilities of allowing a large http body size?

With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...
7
votes
1answer
4k views

CSRF attack on file upload functionality

Is it possible to perform CSRF attacks on file upload functionality? My application uploads files by sending multipart/form-data POST requests without any random token. Is it possible to prepare a ...
7
votes
3answers
2k views

PHP | Security for allowing user uploads

My Situation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I have ...
6
votes
4answers
395 views

Worst case scenario of having the ability to remotely write files to disk as admin

I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
6
votes
3answers
3k views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
6
votes
3answers
1k views

Recreating uploads/linked images with imagecreatefrom* php

As suggested on my StackOverflow question, I am now directing this towards the Information Security group, since no one was able to answer my question despite multiple up-votes. User uploaded images ...
6
votes
2answers
2k views

Directory transversal in PHP with the $_FILES array?

I'm working on a php application that is handling file upload. I'm trying to inject a path transversal payload in the filename such as /../../../../etc/. The thing is that the vulnerable line of code ...
5
votes
5answers
268 views

Should there be an anti-virus used on client provided files?

This is based on Stack Exchange podcast # 25. I really don't understand why there would need to be virus checking on uploaded files. It would generally be a bad idea to execute anything which was ...
5
votes
3answers
12k views

Is it possible for a hacker to bypass upload php file?

I wanna give a filtering system in my script. here it is : <?php $allowedExts = array("gif", "jpeg", "jpg", "png","bmp"); $temp = explode(".", $_FILES["file"]["name"]); $extension = end($temp); ...
5
votes
1answer
1k views

Is it possible to get XSS through uploading an image via the filename?

I just wanted to know if its possible... If i have an image i.e abc.jpeg and i rename it to an XSS vector such as <img src=x onerror=alert(1)>.jpeg will it successfully produce the XSS or is ...
5
votes
1answer
197 views

Can Emule MD4 hashes and file sizes be faked?

Please excuse me if I don't use proper terminology, I'm a lawyer and trying to get more information about something my son has pointed out to me. In Germany, law enforcement agencies use enhanced ...
4
votes
3answers
1k views

Is changing image's extension prone to error for browsers?

In my uploading user's avatar scenario, I change users picture extension to jpg. Is this making the browsers to act differently? Is it prone to error for browsers when they read users avatar? Moreover,...
4
votes
3answers
4k views

Pentesting file upload functionality

I am testing web application which allows to upload files in every format without any restrictions. There is also a function to download uploaded files but when I download file it is returned with ...
4
votes
5answers
2k views

Secure File Sharing with China

I am looking for a convenient, and particularly a secure way to share files with business contacts in China. My priorities, in this order, are Secure, non-hackable. Accessible. I know many sites (...
4
votes
5answers
1k views

Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - ...

1
2 3 4 5 6