In this session, we will see a workshop on the non validated upload of files to a Web application
and the possible mitigation, so
We can click on the Select file button, select a file, for example, a JPEG image and send it to the
webserver with the upload button, going to the server.
You can see that the file has arrived in the uploads folder.
The uploads folder is in the application's virtual directory, and this is already a serious mistake.
The upload function, however, is not developed correctly.
In fact, it is possible to upload a file of a different type from that which the programmer expected
to receive.
For example, we can upload a PDF file and in fact we find in the uploads folder the PDF file sent.
the problem.
In the presence of this vulnerability could arise if the attacker instead of uploading a harmless file.
Went, for example, to upload a webshell.
The webshell is developed with the same technology as the Web application pages, in this
case.
It is in ASP.NET language.
The webshell arrives in the uploads folder, as you can see, at this point the attacker can
load the webshell
and run it.
The webshell is made to run operating system commands on the Web server.
So in this example of running the dir command of the server.
Now, let's see.
What mitigation of this vulnerability consists of?
It is necessary to ensure that it is possible to upload only the type of desired files, for example,
JPG files, and to block the upload of any other type of file.
I then go to extract and check the first four bytes of the uploaded file that indicate the type of file.
And check with a Switch construct if the four bytes extracted correspond to the value of the type of
file that I expect. If there is no match an error message will be printed and
the file cannot be uploaded.
A check is then made on the size of the file that is uploaded so that if it exceeds a set threshold
the file is not accepted. With mitigation applied
Let's now try to rerun
The laboratory.
OK.
And.
I delete previously uploaded files, so let's try the lab again.
Let's first try to choose an allowed file.
An image, for example, and I find the image. OK.
Upload.
And I find the image in the uploads folder, so the upload was successful, but if I try to upload the web
shell, this time
I find an error message and the upload is blocked.