Weakness (CWE)
CWE-434: Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
How to prevent it (8 mitigations)
-
Architecture and Design
Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
-
Architecture and Design
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
-
Architecture and Design
Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.
-
Architecture and Design
Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.
-
Implementation
Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]
-
Implementation
When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE-434
3,441 results · Feed
-
High 8.8CVE-2022-46604 Public exploit
An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechani…
-
Critical 9.1CVE-2023-0587 EPSS 60%
A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length head…
-
High 8.8CVE-2023-24610 Public exploit
NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. Th…
-
High 7.2
An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a craft…
-
Critical 9.8
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution …
-
Critical 9.8
An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to …
-
Critical 9.8
i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.
-
Critical 9.8
An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP fi…
-
High 7.2
OpenMage LTS DataFlow upload remote code execution vulnerability
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 c…
-
Critical 9.8
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrar…
-
Medium 5.9
Path Traversal leading to Local File Inclusion
There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an…
-
High 7.6CVE-2023-0455 Public exploit
Unrestricted Upload of File with Dangerous Type in unilogies/bumsys
Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.
-
High 8.8
File Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary commands and gain esca…
-
Medium 4.3
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting f…
-
Critical 9.8
An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary comman…
-
High 8.8
Arbitrary file write in net.mingsoft:ms-mcms
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
-
High 8.0
Unrestricted file upload leading to privilege escalation in act
act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Act…
-
Critical 9.8
Unrestricted file upload leads to Remote Code Execution in erohtar/Dasherr
erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If …
-
High 8.8
XpressEngine file upload vulnerability
When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on th…
-
High 8.8
PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.
-
High 7.5
An unauthorized user could alter or write files with full control over the path and content of the file.
-
High 7.2
Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an uns…
-
Medium 4.7
SourceCodester Online Food Ordering System Menu Form unrestricted upload
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /fos/admin/index.php?page=menu of the component Menu Form. The manipulation o…
-
High 8.8CVE-2022-46610 EPSS 18%
72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerab…
-
High 7.2
In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for ad…
-
High 8.8
HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload
The File Upload function of EasyTest has insufficient filtering for special characters and file type. A remote attacker authenticated as a general user can upload and execute arbitrary files, to manipulate system or disrupt service.
-
High 8.8
TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a D…
-
High 7.2
Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of ad…
-
Critical 9.8
Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Up…
-
Medium 4.7CVE-2022-4732 EPSS 38%
Unrestricted Upload of File with Dangerous Type in microweber/microweber
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
-
Low 3.1
Unrestricted Upload of File with Dangerous Type in ampache/ampache
Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6.
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
High 8.8
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the result…
-
High 7.8
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privile…
-
Critical 9.8
Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/d…
-
Critical 9.8
AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php
-
High 7.8
When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox…
-
Critical 9.8
here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.
-
Critical 9.8
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
-
High 7.2
In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which…