Insecure File Uploads Attack
An insecure file upload attack occurs when an application allows users to upload files without
properly validating or restricting their content. This can enable an attacker to upload malicious
scripts (e.g., PHP, ASPX, or JavaScript) disguised as legitimate files like images or documents.
Once uploaded, these files may be executed on the server, allowing attackers to gain remote
access (web shells), Execute arbitrary code, overwrite critical files, and further attacks
To help you understand this better, let me walk you through a lab-based attack scenario
involving an Insecure File Upload Attack. Imagine a simple web page built using PHP, where
users are allowed to upload files.
In the screenshot below, you can see that I have uploaded an image.
Proxy the traffic through Burp Suite and analyze the request and response. Send the request to
Repeater, then test it by changing the file extension, removing the content, and adding a payload.
To exploit the vulnerability, begin by injecting the following PHP payload into the target system:
<?php system($_GET['cmd']); ?>
This payload allows remote command execution by passing system-level commands through the
cmd parameter in the URL. Once the payload has been inserted, ensure that the file extension is
changed to .php. This step is crucial because the server must recognize the file as a PHP script in
order to execute the code contained within it.
By uploading the modified file with the .php extension and accessing it through the web browser
with an appropriate command (e.g., ?cmd=ls), the system will execute the command on the
server. This technique is often used during penetration testing to evaluate the security posture of
web applications and to identify improper input validation or insecure file upload mechanisms.
To determine the location where the uploaded file is stored, the URL is typically fuzzed in order
to execute the command embedded in the PHP payload. Fuzzing involves systematically testing
various URL paths or directories on the server to identify where the malicious PHP file has been
placed after the upload.
Once the correct path is discovered, the payload can be triggered by appending the appropriate
cmd parameter to the URL, allowing remote command execution on the server. This technique is
commonly used during web application penetration testing to exploit file upload vulnerabilities
and gain unauthorized access to system-level functionality.
The payload was successfully executed after locating the correct upload path. Once the PHP file
containing the payload was accessed through the web browser and the appropriate cmd
parameter was supplied in the URL, the server processed the command as expected. This
confirmed that the file upload vulnerability could be exploited to achieve remote command
execution, allowing interaction with the underlying operating system.
If the .php extension is blocked by the server during the file upload process, alternative
extensions such as .php1, .php2, .phtml, or .phar can sometimes be used to bypass the restriction.
These extensions may still be interpreted as executable PHP files by misconfigured web servers,
especially those running Apache with certain MIME types enabled.
By uploading the payload with one of these alternate extensions, it is possible to trick the server
into executing the code as PHP, thereby achieving the same effect as a standard .php file. This
technique is often used in penetration testing to bypass basic file extension filters and exploit
weak file validation mechanisms.
[Link]
Conclusion
In this assessment, a file upload vulnerability was successfully exploited to achieve remote
command execution on the target system. By injecting a PHP into the uploaded file and changing
its extension to .php, it became possible to interact with the server through the browser by
passing commands via the cmd parameter. Fuzzing techniques were used to identify the correct
file path where the uploaded script was stored. Once located, the payload was executed
successfully, confirming that the server failed to properly validate and sanitize uploaded files.
This highlights a critical security flaw that could be leveraged by attackers to gain unauthorized
access, execute arbitrary commands, and potentially compromise the entire system. It is essential
that proper file upload validation, server-side filtering, and execution restrictions are
implemented to mitigate such risks.