File Upload and Handling Vulnerabilities

File Upload and Handling Vulnerabilities

File upload functionality presents numerous exploitation opportunities when improperly secured. Test file type restrictions through extension manipulation, content-type headers, and magic byte modification. Double extensions (.php.jpg), null bytes (.php%00.jpg), and case variations sometimes bypass filters. Successful upload of executable content enables straightforward code execution.

File processing vulnerabilities extend beyond simple uploads. Image processing might enable pixel flood DoS or exploitation of image library vulnerabilities. PDF processing could expose SSRF through external resource references. Archive processing might enable path traversal through malicious filenames. Understanding server-side processing guides crafting malicious files for exploitation.

File storage location and naming predictability determines uploaded file accessibility. Brute force or predict uploaded filenames when applications randomize names. Time-based patterns, incremental identifiers, or partial user control over names assist discovery. Directory traversal in filename parameters might enable writing to web roots regardless of intended storage locations.

Content serving misconfigurations transform benign uploads into code execution. Incorrect content-type headers, missing execution preventions, or .htaccess bypasses enable running uploaded files. Test various file extensions and content combinations to identify executable formats. Even image files might achieve code execution through polyglot files containing valid image data and executable code.