Weakness (CWE)
CWE-434: Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
How to prevent it (8 mitigations)
-
Architecture and Design
Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
-
Architecture and Design
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
-
Architecture and Design
Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.
-
Architecture and Design
Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.
-
Implementation
Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]
-
Implementation
When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE-434
1,210 results · Clear filters · Feed
-
High 8.8
CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requi…
-
High 7.2
File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attacker…
-
High 8.8CVE-2022-44384 Public exploit
An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP f…
-
High 7.2
An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers …
-
High 7.2
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ip/youthappam/php_a…
-
High 8.8
Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
-
High 8.8
The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the c…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the c…
-
High 7.2
An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to exec…
-
High 7.2
An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arb…
-
High 8.1
Unrestricted file upload in Eaton Foreseer EPMS
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. …
-
High 7.2
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_…
-
High 7.2
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_act…
-
High 7.2
Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function i…
-
High 7.2
Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function i…
-
High 7.2
Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.
-
High 7.2
An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allo…
-
High 7.2
Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
-
High 8.8
In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.
-
High 8.2
sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload
sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containi…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the …
-
High 7.2
An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0…
-
High 7.2
Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.
-
High 8.8
Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users wit…
-
High 8.8
Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/users_add…
-
High 8.8
Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Managem…
-
High 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the c…
-
High 7.2
An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows at…
-
High 8.8
Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.
-
High 8.8
Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php.
-
High 7.2CVE-2022-42092 Public exploit
Backdrop CMS Unrestricted File Upload vulnerability
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.
-
High 8.8
mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbi…
-
High 7.2
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /ph…
-
High 8.8
A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a …
-
High 7.2
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
-
High 8.8CVE-2022-40878 EPSS 24%
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to ac…
-
High 7.2
CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
-
High 7.2
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" f…
-
High 7.2
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" …