Weakness (CWE)
CWE-434: Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
How to prevent it (8 mitigations)
-
Architecture and Design
Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
-
Architecture and Design
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
-
Architecture and Design
Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.
-
Architecture and Design
Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.
-
Implementation
Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]
-
Implementation
When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE-434
3,441 results · Feed
-
Critical 9.8
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party…
-
Critical 9.8
The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
Critical 9.8
The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
Critical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third par…
-
Critical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third…
-
Critical 9.8
The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third…
-
Critical 9.8
The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
Critical 9.8
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third par…
-
High 8.8
The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third part…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the c…
-
Critical 9.8
The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third pa…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the c…
-
Critical 9.8
Frauscher Sensortechnik Diagnostic System FDS102 for FAdC R2 and FAdCi R2 configuration upload vulnerability
Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the configuration upload function. This could lead to a complete compromise of the FDS102 device.
-
High 7.2
An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to exec…
-
High 7.2
An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arb…
-
Medium 6.3
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
-
Critical 9.9
File Upload vulnerability in Forma LMS
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the SCORM importer feature. The exploitation of this vulnerabilit…
-
Critical 9.9
Unrestricted Upload of File with Dangerous Type in Forma LMS
There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerabili…
-
Medium 6.3
easyii CMS File Upload Management Upload.php file unrestricted upload
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be init…
-
Critical 9.8
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via …
-
Critical 10.0
Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
-
High 8.1
Unrestricted file upload in Eaton Foreseer EPMS
A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduction of energy consumption and avoid unplanned downtime caused by the failures of critical systems. …
-
High 7.2
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_…
-
High 7.2
Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_act…
-
Medium 5.5
wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.
-
High 7.2
Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function i…
-
High 7.2
Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function i…
-
Critical 9.8
A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated at…
-
Critical 9.8
Badaso vulnerable to Remote Code Execution via malicious file upload
Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
-
Critical 9.8
Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a file upload ability. The affected code fails to validate fileMd5 and fileName parameters, resulting in…
-
High 7.2
Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.
-
High 7.2
An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allo…
-
High 7.2
Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
-
High 8.8
In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.
-
High 8.2
sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload
sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containi…
-
High 7.2
Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the …
-
High 7.2
An arbitrary file upload vulnerability in the component /php_action/editProductImage.php of Billing System Project v1.0…
-
Critical 10.0
ZGR TPS200 NG Missing Reference to Active Allocated Resource
In ZGR TPS200 NG 2.00 firmware version and 1.01 hardware version, the firmware upload process does not perform any type of restriction. This allows an attacker to modify it and re-upload it via web with malicious modifications, rendering the device unusable.
-
Critical 9.0
Gin-vue-admin - Unrestricted File Upload
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low priv…
-
High 7.2
Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.