Weakness (CWE)
CWE-434: Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
How to prevent it (8 mitigations)
-
Architecture and Design
Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
-
Architecture and Design
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
-
Architecture and Design
Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
For example, limiting filenames to alphanumeric characters can help to restrict the introduction of unintended file extensions.
-
Architecture and Design
Define a very limited set of allowable extensions and only generate filenames that end in these extensions. Consider the possibility of XSS (CWE-79) before allowing .html or .htm file types.
-
Implementation
Ensure that only one extension is used in the filename. Some web servers, including some versions of Apache, may process files based on inner extensions so that "filename.php.gif" is fed to the PHP interpreter.[REF-422] [REF-423]
-
Implementation
When running on a web server that supports case-insensitive filenames, perform case-insensitive evaluations of the extensions that are provided.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE-434
3,441 results · Feed
-
High 8.8
Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users wit…
-
Critical 9.8
An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to …
-
Critical 9.0
Gin-vue-admin - Unrestricted File Upload
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low pri…
-
High 8.8
Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/users_add…
-
High 8.8
Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Managem…
-
High 7.2
Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the c…
-
Critical 9.8
The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a…
-
Critical 9.8
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a …
-
Critical 9.8
The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a …
-
Critical 9.8
The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a …
-
High 7.2
An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows at…
-
Critical 9.8
The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by…
-
Critical 9.8
The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thir…
-
High 8.8
Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.
-
High 8.8
Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php.
-
Critical 9.8
The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted …
-
Critical 9.8
The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a thi…
-
Critical 9.8
The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a th…
-
High 7.2CVE-2022-42092 Public exploit
Backdrop CMS Unrestricted File Upload vulnerability
Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this and argue that advanced permissions are required.
-
Unscored —
Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and ach…
-
High 8.8
mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbi…
-
High 7.2
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /ph…
-
Critical 9.1
Discourse vulnerable to RCE via admins uploading maliciously zipped file
Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary…
-
High 8.8
A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a …
-
High 7.2
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
-
High 8.8CVE-2022-40878 EPSS 24%
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to ac…
-
Critical 9.8
EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability w…
-
Critical 9.8
ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1.
-
High 7.2
CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
-
High 7.2
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" f…
-
High 7.2
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" …
-
Low 3.1
Server-side Denial of Service while processing a specifically crafted GIF file
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Den…
-
Critical 9.8
Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_c…
-
High 7.2
In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gall…
-
Medium 6.5
WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability
Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.