OSCP vs OSCE make the right decision for your career
OSCP and OSCE are some of the best and the most popular technical certifications in the field of cybersecurity. A lot of skilled penetration testers around the world are chasing ...
secure coding + Systems security + Website security + blog Z. Oualid today
As an old developer and a penetration tester, between all the vulnerabilities I have seen in my whole experience in both fields file upload was the most difficult one to fix and the most dangerous. The difficulty resides in the number of things you should check before allowing a file to get into your server. Therefore, how to prevent file upload vulnerability in PHP?
Here is a list of the things you should do to fix the file upload vulnerability:
I have decided to make this blog post to resume all the things you should do as a developer to fix this issue with PHP code examples. In addition, I want it to be like a reference for developers while fixing this issue. So if you are interested to learn more about this subject just keep reading.
This blog post is divided into two big parts depending on the level of security you want to get to. The basic file checks are the minimum checks you need to perform on the uploaded files to avoid the unrestricted file upload vulnerability. In addition, the advanced security check and controls explain what else you can do to enhance the security level of your application.
The first thing you need to check before performing actions on the file once the user sends the file is to look at his size. If the size is so big then the next checks would be useless and could cause a denial of service. Therefore, to check the file size you can use the following code snippet:
if ($file['size'] >2000000) // the value here is in octet so 2Mo
{
Return “error, big file”;
}
This check is very important and must be performed in the backend. However, it is not 100% reliable, as it is very easy to bypass. The reason behind this is that the function responsible for the check of the file type relies on the magic numbers of the file. Unfortunately, those numbers could easily be altered or forged to pass malicious files. Therefore this check should never be the only security check you do to the file.
Let’s suppose you only want to allow PDF files for example in the case of CV uploader. Therefore, here is the MIME you need to look for in the uploaded files (application/pdf)
Here is an example of such a check:
$finfo = new finfo(FILEINFO_MIME_TYPE);
$accepted_file_types = array(‘pdf’ =>“application/pdf”);
If(!in_array($finfo->file($filename), $accepted_file_types) )
{
return “Error: File type not allowed”;
}
It is recommended to change the file name of the uploaded file before storing it in the file system. This change protects you from any file destruction or replacement that could happen by uploading a configuration file like .htaccess or something like this.
It is also recommended to use a powerful hashing algorithm to avoid any collision problems.
Here is a code snippet that you can use to generate the file name:
$filename = hash('sha256', $file['tmp_name'] . date("Y-m-d h:i:s"));
If you want to add more checks to avoid the hash functions collision problems, you can add a file existence check once the filename is generated. Here is a source code that can do this for you:
If(file_exists($path.$filename))
{
// here you can return an error or perform a new generation of the file name
}
One of the attacks that a hacker can perform against your web application and that can lead to a denial of service is uploading multiple small files. Therefore, you need to limit the number of files that a user can upload. For example, if you allow profile photos uploading, you need to remove the old one from the server once the new one is correctly uploaded.
This part of the blog post describes some of the advanced security checks you can add to your application source code or your server configuration. Some of the following recommendations may require server control to be implemented.
The main idea of uploading a malicious file to the server file system is to perform remote code execution. Therefore, removing the execution permission from folders where files are uploaded will enhance the security of your application against file upload.
The PUT HTTP Verb is one of the most dangerous attacks that can happen to a web application. This verb can be exploited to upload files to specific folders without using the application functionalities. Therefore, using this technique the attacker can bypass all the previous security checks and controls.
In most cases, the uploaded files are copied to a public folder, to be easier for the developer to call it whenever it is needed in his source code. However, this technique puts the user’s data in danger especially if those files contain personal information. Therefore, it is very recommended to put all the files in a private folder in the webserver that cannot be directly accessible and then create a function to call their content whenever you need.
It is understandable that developing this functionality will take more programming time, and I fully understand it, but it will really make a big difference while having a cyber-attack.
The last security check that I always recommend especially for big companies, is to perform a malware scan for each uploaded file. In many cases, even the allowed file type can contain malicious codes that can infect your machine. For example, a .pdf CV can contain a malicious file that once your employee clicks on it will trigger malware that encrypts all your system.
Written by: Z. Oualid
I am a Cyber Security Expert, I have worked with many companies around the globe to secure their applications and their networks. I am certified OSCP and OSCE which are the most recognized and hard technical certifications in the industry of cybersecurity. I am also a Certifed Ethical hacker (CEH). I hope you enjoy my articles :).
Education Z. Oualid
OSCP and OSCE are some of the best and the most popular technical certifications in the field of cybersecurity. A lot of skilled penetration testers around the world are chasing ...
Copyright © 2020 Getsecureworld.
Post comments (0)