Unrestricted File Upload

Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code e

Vulnerability Name: Unrestricted File Upload on [Domain name]

Vulnerability Description: The application is vulnerable to unrestricted file uploads. Effective controls have not been implemented to restrict users from uploading malicious content to the web server. Files containing active code can be uploaded and executed on the server allowing for a number of serious attacks against the application and infrastructure.

[Don't forget to add your vulnerability description, the one given above is general description]

Payload: [Content of malicious file uploaded on server]

Steps to Reproduce:

  1. Login to the application.

  2. Go to the [URL].

  3. Upload the malicious file, say it asexploit.php.

  4. Once uploaded, go to the [path of file uploaded].

  5. You should see the web shell there.

  6. This is Unrestricted file upload.

Proof-of-concept: Snapshots or video link attached

Impact: Unrestricted file upload is a serious vulnerability with significant impact on the application and its infrastructure. An attacker with the ability to upload a malicious file to the application can set up drive-by-download attacks, deface the website, or gain access to the file system through a web shell. Once an attacker has remote access to the server, they can ex-filtrate sensitive data, compromise the integrity of application data, or cause denial of service to the application.

Attack Scenario: Suppose there's a unrestricted file upload vulnerability on some documents upload page, here the attacker can upload a web shell on that page, and find a way to access that shell. once he gets access then he can take down the whole company.

[The above was a basic attack scenario you need to alter it according to the Workflow]

Remediation: Restrict file types accepted for upload: check the file extension and only allow certain files to be uploaded. Use a whitelist approach instead of a blacklist. Check for double extensions such as .php.png. Check for files without a filename like .htaccess (on ASP.NET, check for configuration files like web.config). Change the permissions on the upload folder so the files within it are not executable. If possible, rename the files that are uploaded.