Re: File Upload with changed extension

Hi,

it could be also a risk on the client for some XSS. There is a existing =
and very easy scenario to implement: Using a valid GIF-file to inject =
JavaScript-code to a page. If the page provides some upload =
functionality and the uploaded files will be visible to other users =
afterwards you can use this for some XSS, as the javascript code is =
executed within pages context.=20

In this scenario for the server its a real gif-file, as a correct GIF89a =
header is used, but the browser will detect a wrong mime-type and will =
use this file as javascript, as javascript code is detected within this =
file. But there is a solution: The nosniff-HTTP-header =
(X-Content-Type-Options: nosniff) - this will prevent the browser from =
re-checking mime-types.=20

See a blog article from Ajin Abraham about this: =
http://iamajin.blogspot.in/2014/11/when-gifs-serve-javascript.html

Bye


Tobias

> Am 03.12.2014 um 02:42 schrieb Guillermo Caminer =
<[email protected]>:
>=20
> Hi!
>=20
> There could be a risk involved, if:
> 1) The image is uploaded inside the Document Root
> 2) Have some malicious code inside (ex: a php shell) that is not =
validated
> 3) The Web Server somehow executes this malicious code (for example, =
you can put php code inside a
> GIF, after the magic number, and the web app include/require this file =
in a php script, then the php
> engine will execute the php code when it sees the php opening tag, =
even if it's inside the image)
>=20
> Also, beware of the null byte, or example,  can you upload a filename =
like this phpShell.php%00.jpg?
>=20
> The best practice is:
> a) Always upload outside the DocRoot
> b) Do not trust Content-type and filename headers nor the magic number
> c) Validate the content of the file
> d) Scan the file with an antivirus
> e) Be careful if you include/require the file
>=20
> Hope it helps!
>=20
> Best regards.
>=20
> On 02/12/14 15:44, Jyotiranjan Acharya wrote:
>> If you are able to upload a file with a changed extension, then will
>> that be a problem?
>> For example, you can not ,in any way, upload a .exe  or =
.php/.jsp/.asp
>> file directly into a web App, but you can by changing their extension
>> to .JPG. What is the risk in such a case?
>>=20
>>=20
>>=20
>> This list is sponsored by Cenzic
>> --------------------------------------
>> Let Us Hack You. Before Hackers Do!
>> It's Finally Here - The Cenzic Website HealthCheck. FREE.
>> Request Yours Now!=20
>> http://www.cenzic.com/2009HClaunch_Securityfocus
>> --------------------------------------
>>=20
>>=20
>=20
>=20
>=20
> This list is sponsored by Cenzic
> --------------------------------------
> Let Us Hack You. Before Hackers Do!
> It's Finally Here - The Cenzic Website HealthCheck. FREE.
> Request Yours Now!=20
> http://www.cenzic.com/2009HClaunch_Securityfocus
> --------------------------------------
>=20




This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------