PCI v3.2-6.5.1
CWE-434
ISO27001-A.14.2.5
OWASP 2013-A1
OWASP 2017-A1
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Unrestricted File Upload

Severity:
High
Summary

Invicti detected an unrestricted file upload, which allows users to upload files to the web server.

If one of the uploaded files result a code execution, Invicti will report it as a separate issue.

Impact

The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, and simple defacement. It depends on what the application does with the uploaded file and especially where it is stored. Here is the list of attacks that the attacker might do:

  • Compromise the web server by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
  • Put a phishing page into the website.
  • Put a permanent XSS into the website.
  • Bypass cross-origin resource sharing (CORS) policy and exfiltrate potentially sensitive data.
  • Upload a file using malicious path or name which overwrites critical file or personal data that other users access. For example; the attacker might replace the .htaccess file to allow him/her to execute specific scripts.
Remediation
  • Never accept a filename and its extension directly without having a white-list filter.
  • If there is no need to have Unicode characters, it is highly recommended to only accept alpha-numeric characters and only one dot as an input for the file name and the extension.
  • Limit the file size to a maximum value in order to prevent denial of service attacks.
  • Uploaded directory should not have any "execute" permission.
  • Don't rely on client-side validation only.
Required Skills for Successful Exploitation
Actions To Take
Vulnerability Index

You can search and find all vulnerabilities

Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Featured resources

Blog

Strengthening enterprise application security: Invicti acquires Kondukto

Blog

Modern AppSec KPIs: Moving from scan counts to real risk reduction

Blog

Friends don’t let friends shift left: Shift smarter with DAST-first AppSec

Blog

Vibe talking: Dan Murphy on the promises, pitfalls, and insecurities of vibe coding

Blog

What lies ahead for CMS.

Blog

How to integrate CMS with other tools.

Blog

Improve user experience through CMS.

Blog

How CMS can benefit e-commerce.

Blog

Stay updated on CMS trends.

Blog

Tips for improving CMS performance.

Blog

Learn how to secure your CMS.

Blog

Explore the advantages of CMS.

Blog

A comprehensive guide to CMS.

Build your resistance to threats. And save hundreds of hours each month.