IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [file-upload]

File upload means sending a file from a local system to a remote system such as a server or another client with the intent that the remote system should store a copy of the file being transferred.

286 questions
120
votes
11 answers

Hacker used picture upload to get PHP code into my site

I'm working on a website — right now it's in early stages of testing, not yet launched and just has test data - thank goodness. First of all, a hacker figured out the password to log onto the websites 'administration' pages*. I think they used a key…
Williamz902
  • 1,285
  • 2
  • 8
  • 6
56
votes
5 answers

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: What if image.gif will return some js attack vector, but not the image? Is there any known vectors? I've tried…
Paul Podlipensky
  • 2,837
  • 4
  • 21
  • 25
45
votes
2 answers

Risks of a PHP image upload form

My client wants a photography site where users can upload their photos in response to photography competitions. Though technically this isn't a problem, I want to know the risks associated with allowing any user to upload any image onto my server.…
Starkers
  • 553
  • 1
  • 5
  • 6
34
votes
5 answers

Does changing an uploaded executable's file extension to .png render it safe?

A colleague of mine has a personal website in which he allows users to upload anything within a certain size, but before the actual upload he checks to see the file extension: if ( $type == 'image/gif'){ $ext = '.gif'; } elseif ( $type ==…
Mister Verleg
  • 501
  • 5
  • 7
32
votes
5 answers

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
Edgar
  • 655
  • 1
  • 6
  • 8
31
votes
2 answers

Exploits or other security risks with SVG upload?

I have a site, where people can upload graphics, you might think of it like an image hoster or a forum for pictures. Now, I allow upload of raster graphics to a certain size, but no vector graphics as of yet. I'd like to allow SVG upload as well,…
polemon
  • 413
  • 1
  • 4
  • 6
28
votes
3 answers

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. My users are allowed to upload their own images…
xun
  • 383
  • 1
  • 3
  • 6
27
votes
8 answers

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, would allowing PHP to be inserted on my servers…
Michael d
  • 487
  • 5
  • 8
24
votes
3 answers

What steps should be taken to validate user uploaded images within an application?

Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type. But what else can be done to ensure the image is valid? In my case the upload is handled…
Mark Davidson
  • 9,367
  • 6
  • 43
  • 61
21
votes
9 answers

Keep encrypted files in sync on a cloud service, without having to upload an entire encrypted volume each time

Situation: User has several folders worth of GBs which they want to keep in sync on a cloud service (for example Mega or Dropbox) in an encrypted form; User does not want to sync a single encrypted volume, because this would mean, obviously,…
nico
  • 341
  • 1
  • 2
  • 9
20
votes
4 answers

What are the security threats of zip file uploads and what preventive actions should be taken?

We have a Drupal application developed for sharing files. We are allowing zip files to be uploaded by logged in departmental user. We are using Drupal private file system (outside webroot). We are using php Fileinfo for validation. Only logged in…
msmani
  • 301
  • 1
  • 2
  • 7
20
votes
3 answers

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning Content-Type: text/plain. For example, any code-hosting…
Andrei Botalov
  • 5,267
  • 10
  • 45
  • 73
20
votes
4 answers

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Let's say I develop an application that, Allows any user to upload a file of only white listed mime content type and extensions (word and pdf). Serves those files with the allowed extension and content type. Is this a security risk? Why? Will any…
Andy
  • 505
  • 2
  • 5
  • 11
19
votes
4 answers

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different user later on? I.e. another user downloads the…
Mark E. Haase
  • 1,902
  • 2
  • 15
  • 24
18
votes
6 answers

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ?
Grim Reaper
  • 518
  • 1
  • 4
  • 14
1
2 3
…
19 20