Unsafe file upload vulnerability Overview
File upload function in the web are common applications, such as many sites registered when the need to upload picture, upload attachments, and so on. When the user clicks the Upload button, the background will upload the file to determine whether such is the specified type, extension, size, etc., and then rename the directory after storage in accordance with the format specified design. If the background of the uploaded files without any judgment or judgment of the security condition is not stringent enough, an attacker could upload a malicious file, such as a word Trojan, causing back-end server is webshell .
So, when designing a file upload function, be sure to strict security file passed in. For example:
- verify the file type, extension, size ;
- uploading verification documents ;
- the file certain complex renaming ;
- Do not expose the path after file upload ;
- and so on ...
client check
1. Try uploading php sentence,
2. The php word picture suffix to suffix, such as JPG , PNG , continue to upload and capture
3. the .jpg suffix to php after contracting, uploaded successfully
MIME type
1. Try uploading php sentence,
2. The change jpg suffix, capture, change php suffixes, contracting,
3. In fact, this was supposed to be by limiting the whitelist, follow the prompts view, you can modify the mime type of bypass, burpsuite reform package which uploads
Here changed image / jpeg
Contract, uploaded successfully,
getimagesize
1. Code of MIME type is also verified, but this is a small problem, we found it by following the getimagesize () function to obtain information about a picture, upload pictures to verify whether the picture is fake and limit the system to upload size can not exceed 50KB , and the name of the file after the upload has been renamed the operation.
2. First, we need to modify the Trojan file, add in front of the file GIF89a thereby bypassing deceive getimagesize function, or by the windows of dos be pictures and interface php merger .
3.利用本地包含漏洞include.php?filename=../../unsafeupload/uploads/2020/02/22/2455306d6b5aec7d419826309450.jpg可运行马
