#SecurityExplained S-101: CWE Top 25:
CWE-434: Unrestricted Upload of File with Dangerous Type
The software allows an attacker to upload or transfer harmful data that can be processed automatically within the product's environment.
1/
CWE-434: Unrestricted Upload of File with Dangerous Type
The software allows an attacker to upload or transfer harmful data that can be processed automatically within the product's environment.
1/
2/
This flaw could affect any software that allows users to upload files.
The arbitrary file upload weakness concerns improper or missing file type validation when uploading files.
This flaw could affect any software that allows users to upload files.
The arbitrary file upload weakness concerns improper or missing file type validation when uploading files.
3/
This flaw happens when an application fails to validate or verifies files incorrectly before uploading them to the system. This flaw is language independent. However, it is most common in ASP and PHP-based apps.
This flaw happens when an application fails to validate or verifies files incorrectly before uploading them to the system. This flaw is language independent. However, it is most common in ASP and PHP-based apps.
4/
If a user interprets and executes an uploaded file as code, arbitrary code execution is possible.
If a user interprets and executes an uploaded file as code, arbitrary code execution is possible.
5/
This is especially true for files with the .asp and .php extensions uploaded to web servers because these file types are frequently viewed as executable by default, even if the file system permissions do not specify execution.
This is especially true for files with the .asp and .php extensions uploaded to web servers because these file types are frequently viewed as executable by default, even if the file system permissions do not specify execution.
6/
In Unix systems, for example, programmes can't run until the execute bit is set. In contrast, PHP programmes can be run by the webserver without calling them directly on the operating system.
In Unix systems, for example, programmes can't run until the execute bit is set. In contrast, PHP programmes can be run by the webserver without calling them directly on the operating system.
7/
# Potential Impact:
• An attacker might upload and run arbitrary code on the target machine, resulting in the execution of arbitrary HTML and script code or a system compromise.
# Mitigation:
• When possible, save uploaded files somewhere other than the webroot directory.
# Potential Impact:
• An attacker might upload and run arbitrary code on the target machine, resulting in the execution of arbitrary HTML and script code or a system compromise.
# Mitigation:
• When possible, save uploaded files somewhere other than the webroot directory.
8/
• Instead of using the user-supplied filename, generate a new, unique filename for an uploaded file without external input.
• Define a small number of acceptable filename extensions and only generate filenames with these extensions.
• Instead of using the user-supplied filename, generate a new, unique filename for an uploaded file without external input.
• Define a small number of acceptable filename extensions and only generate filenames with these extensions.
9/
• When necessary, ensure that only files with allowed extensions can be directly accessed from the upload directory; for example, if a directory should only contain images, block access to any PHP/ASP files.
• When necessary, ensure that only files with allowed extensions can be directly accessed from the upload directory; for example, if a directory should only contain images, block access to any PHP/ASP files.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
