Re: File Upload with changed extension

[Tobias Wassermann <mail () tobias-wassermann de>]

Hi,

it could be also a risk on the client for some XSS. There is a existing and very easy scenario to implement: Using a 
valid GIF-file to inject JavaScript-code to a page. If the page provides some upload functionality and the uploaded 
files will be visible to other users afterwards you can use this for some XSS, as the javascript code is executed 
within pages context. 

In this scenario for the server its a real gif-file, as a correct GIF89a header is used, but the browser will detect a 
wrong mime-type and will use this file as javascript, as javascript code is detected within this file. But there is a 
solution: The nosniff-HTTP-header (X-Content-Type-Options: nosniff) - this will prevent the browser from re-checking 
mime-types. 

See a blog article from Ajin Abraham about this: http://iamajin.blogspot.in/2014/11/when-gifs-serve-javascript.html

Bye


Tobias

> Am 03.12.2014 um 02:42 schrieb Guillermo Caminer <flaco.webappsec () gmail com>:
>
> Hi!
>
> There could be a risk involved, if:
> 1) The image is uploaded inside the Document Root
> 2) Have some malicious code inside (ex: a php shell) that is not validated
> 3) The Web Server somehow executes this malicious code (for example, you can put php code inside a
> GIF, after the magic number, and the web app include/require this file in a php script, then the php
> engine will execute the php code when it sees the php opening tag, even if it's inside the image)
>
> Also, beware of the null byte, or example,  can you upload a filename like this phpShell.php%00.jpg?
>
> The best practice is:
> a) Always upload outside the DocRoot
> b) Do not trust Content-type and filename headers nor the magic number
> c) Validate the content of the file
> d) Scan the file with an antivirus
> e) Be careful if you include/require the file
>
> Hope it helps!
>
> Best regards.
>
> On 02/12/14 15:44, Jyotiranjan Acharya wrote:
> > If you are able to upload a file with a changed extension, then will
> > that be a problem?
> > For example, you can not ,in any way, upload a .exe  or .php/.jsp/.asp
> > file directly into a web App, but you can by changing their extension
> > to .JPG. What is the risk in such a case?
> >
> >
> >
> > This list is sponsored by Cenzic
> > --------------------------------------
> > Let Us Hack You. Before Hackers Do!
> > It's Finally Here - The Cenzic Website HealthCheck. FREE.
> > Request Yours Now! 
> > http://www.cenzic.com/2009HClaunch_Securityfocus
> > --------------------------------------
>
>
>
> This list is sponsored by Cenzic
> --------------------------------------
> Let Us Hack You. Before Hackers Do!
> It's Finally Here - The Cenzic Website HealthCheck. FREE.
> Request Yours Now! 
> http://www.cenzic.com/2009HClaunch_Securityfocus
> --------------------------------------




This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------