International Journal of Engineering Trends and Technology (IJETT) – Volume-42 Number-7 - December 2016

Understanding File Upload Security for Web

Applications
Karishma Pooj#1, Sonali Patil*2
#
Student, *Professor, Department of Information Technology (Information Security),
K.J. Somaiya College of Engineering (Aff. To Mumbai University),
Vidyavihar East, Mumbai, India

Abstract- In today’s times the web model has to phish for user information or implant malware.
become an important mechanism in terms of According to a report by the Web Application
information and services delivery over the internet. Security Consortium, about 49% of the web
With the success of the internet, it becomes important applications being reviewed contain vulnerabilities of
to take into account the security of the web high risk level and more than 13% of the websites can
application layer from various unauthorized user be compromised completely automatically [2].
attacks. There are many factors due to which it becomes
The main reason for security awareness is due to lack difficult to secure applications which have be taken
of trustworthiness of the applications programming into consideration to improve application security.
logic or input validation. The best way of preventing Insecure applications are built due to shortcomings of
application exploitability is to enforce good security many factors such as security testing done too late in
policies through the applications. This can be done the SDLC, skipping out on security testing because of
only when the client and server collaborate to the release rush, budget restraints and more
achieve the desired security goals eliminating the commonly, the lack of security awareness by
possibility of such attacks. In this paper we focus on developers. The lack of developer awareness of
file upload exploits with respect to web application secure coding standards along with the lack of budget
security. Various test cases will be explained along spent on mobile application security are two of the
with the impact which will help security testers and scariest issues. The primary goal of this paper is for
application developers to maintain the confidentiality developers and testers to understand the common
and integrity of user data. Finally, potential steps for vulnerabilities on file upload functionality which
mitigation will be provided in order to restrict such leads to attacks and their respective mitigations for
attacks. future secure development.
Keywords— Web Application Security, Malicious
File Upload, File Upload Security II. LITERATURE REVIEW
I. INTRODUCTION The following papers were referred to understand
web application security:
World Wide Web is considered as the main
infrastructure of the global information society on
A. A Survey on Web Application Security
which the world is highly dependent. The Web
X. Li | Y. Xue [1] have conducted surveys with respect
platform is a complex ecosystem composed of a large
to web application security techniques. They have
number of components and technologies, including
categorized three essential properties: state integrity,
HTTP protocol, web server and server-side
input validation and logic correctness required for
application development technologies, web browser
application security along with the future scope of the
and client-side technologies [1]. The internet and its
research.
services are now easily accessible to us on portable
devices Web applications have had a huge impact on
B. End-to-end Web Application Security
fields such as business, education, health and social
U. Erlingsson | B. Livshits | Y. Xie [3] support the
life, drastically changing the cultural norms and
argument that there should be collaboration between
individual behaviors. Every week thousands of new
the server and client to improve security. They also
web applications with the power to simplify and ease
provide examples mechanisms in order to achieve
the human activity process hit the market. But it is
end-to-end security.
also important to understand that with such power it
also becomes the responsibility of application
C. A review on Application Security Vulnerabilities
builders to be vigilant about security to protect users.
A. Garg | S. Singh [4] provides a look at common web
With the growing popularity of the good guys
application vulnerabilities such as remote code
developing the applications, there are thousands of
execution, SQL injection, format string
hackers working hard to break into these apps to try
vulnerabilities, cross site scripting, username

ISSN: 2231-5381 http://www.ijettjournal.org Page 342

 International Journal of Engineering Trends and Technology (IJETT) – Volume-42 Number-7 - December 2016

enumeration along with their examples and IV. RESULTS

mitigations to overcome their shortcomings.
Different ways in which file upload functionality can
D. Systematic Review of Web Application Security be exploited are as explained below:
Vulnerabilities Detection Methods
S. Rafique | M. Humayun | Z. Gul | H. Javed [5] A. Case 1 – No Filter
explain the cause of vulnerabilities related to web Summary:
application layer. The paper also provides a review No validation is performed at client end or server
on techniques, stages, approach and tools to detect end.
vulnerabilities. Steps:
Select an executable file (e.g. Calc.exe) to be
E. Web Server Security and Survey on Web uploaded. Submit the file in the upload feature and
Application Security observe if the file is uploaded successfully.
S. Almin [6] has described the importance of web Vulnerability Reason:
server along with the threats posed by hackers. In this type we directly upload an
Countermeasures against web server threats are also executable/malicious file. The possibility of this
explained. vulnerability occurring is when no validation is
applied in application at the client and server end.
F. Security Testing of Web Applications: Issues
and Challenges B. Case 2 – Bypass client side validation
A. Jaiswal | G. Raj | D. Singh [7] provide an insight on Summary:
the challenges and issues that occur during security Validations applied at client side can be bypassed
testing of web applications. This is done in order to using developer options.
provide inputs to testers and managers with respect to Steps:
their projects. Select an executable file (e.g. Calc.exe) to be
uploaded. Before uploading, select the developer
This paper adds to the list of issues highlighted by options using the F12 button.
other authors based on OWASP top 10 categorization
In the JavaScript file, search for the function
[8].
which validates the type of upload and apply break
points.
III. HOW FILE UPLOAD WORKS
Start debugging and submit the file in the upload
File upload in simple words can be described as feature.
transferring a file (photo, audio file, etc.) to a server During execution, change the extension of
on the web. To upload data to a server, the Client first allowable file type to malicious type in JavaScript
starts communication with a server by initiating a function and observe if the file is uploaded
TCP/IP connection from the client to the server called successfully.
the handshake. In this communication, the client Another way to perform this is to return a true
starts any communication and not the server. When a value from the JavaScript function which performs
connection is established between the client and file validation.
servers, data transfer can take place between them. Vulnerability Reason:
This does not need any port forwarding to The breakpoints applied are to change the
send/receive data to/from a server. Now the client allowable extension from a particular type (say
needs a file to be uploaded and form in a Web page .pdf) to another type(.exe) which is disallowed.
through which the file is sent to the server. This lets The file is uploaded due to validations performed
the user include one or more files into the form only at client side.
submission. The below is a simple example of file
upload form: C. Case 3 – Perform stored XSS on file name
<FORM METHOD=” post” ECTYPE=” Summary:
multipart/form-data” ACTION=””> An attacker is able to perform stored XSS using
<INPUT TYPE=” file” NAME=” Example.exe”> file upload feature.
<INPUT TYPE =” Submit” VALUE=” Send File”> Steps:
</FORM> Select a white-listed file (e.g. Test.txt) and upload
Once the form is sent over the channel to the server it the file using the submit feature.
is often processed so that the files are stored onto the As soon as the submit button is clicked, intercept
disk of the Web server. Now the server-side script is the request using a proxy tool.
to be executed once the file is received on the server. Change the file name from “Test.txt” to
The server knows how to handle such a request and “XSS<img src=””
stores the data. It saves the file onto the server’s disk onerror=alert(document.cookie)>Test.txt” and
under some name, but it might just as well process forward the request to the server.
the data only by extracting some information from it.

ISSN: 2231-5381 http://www.ijettjournal.org Page 343

 International Journal of Engineering Trends and Technology (IJETT) – Volume-42 Number-7 - December 2016

Vulnerability Reason: Vulnerability Reason:

The attack is possible as there is no sanitization on This vulnerability is possible when the validation
file name. is done only based on the content-type, but the
body contains executable functions.
D. Case 4 – No file content validation
Summary: G. Case 7 – Bypassing blacklisting using Multiple
No validation is performed to check the contents extension (Type I)
of the file uploaded by the end user. Summary:
Steps: This type is possible by using more than one type
Select a white-listed file (e.g. Test.txt) and upload of file extension.
the file using the submit feature. Steps:
As soon as the submit button is clicked, intercept Select an executable file (Test.exe) and rename it
the request using a proxy tool. to an allowable file extension (Test.exe.jpg).
Add EICAR value in the file body and forward the This can also be done by intercepting the request
request to the server. using a proxy tool and changing the values.
Vulnerability Reason: Upload this file/forward the request and observe
Since file is a part of allowable extensions, client the results.
side validation allows the file to be uploaded. No Vulnerability Reason:
content validation is performed at server side; Assuming that .htaccess file has following line of
hence the file is uploaded. code:

E. Case 5 – No file size validation AddHandler php5-script.php

Summary:
No validation is performed to check the size of the This line checks only if the uploaded extension is a
file uploaded by the end user. PHP; it doesn’t necessarily check what order it is
Steps: placed in. For example, it would execute all the
Select a white-listed file whose size should be following files as PHP due to vulnerable code in
larger than required, based on the business logic .htaccess file:
(say 100Mb). Upload the file using the submit
feature. Test.php.jpg, test.php.pdf, etc.
As soon as the submit button is clicked, intercept
the request using a proxy tool. H. Case 8- Bypassing blacklisting using
Change the value of size parameter in the request Multiple extension (Type II)
and forward the request to the server. Summary:
Another way to do is to change the value of the This type is performed by separating file
JavaScript function which validates the size of file extensions using Semi colons. This attack is
to true. possible on IIS server 6 or prior.
Vulnerability Reason: Steps:
Since file is a part of allowable extensions, client Select an executable file (Test.exe) and rename
side validation allows the file to be uploaded. No it(Test.exe;.jpg) to an allowable file extension.
file size validation is performed at server side; This can also be done by intercepting the request
hence the file is uploaded. using a proxy tool and changing the values.
F. Case 6 – Bypassing validation based on content Upload this file/forward the request and observe
type/mime type the results.
Summary: Vulnerability Reason:
When the validation is based just on content type, During file upload, when Test.exe;.jpg is
attack can be made by manipulating the content- uploaded, server will only check the first dot from
type of a file which specifies the nature of data. the right. When it sees .jpg, the server allows the
Steps: file to get successfully uploaded concluding that
Select the executable file (Test.exe) to be this extension is not in the list of dangerous
uploaded. Upload this file into the upload feature extension. IIS server executes Text.exe;.jpeg as
by clicking on the submit button also intercepting Text.exe. Also “test.exe/file.txt” is later executed
the request in a proxy tool. as test.exe.
Now we change the content-type of an executable I. Case 9 – Bypassing blacklisting using
file from application/x-msdownload to an multiple extensions (Type III)
allowable content-type (say text/plain) and forward Summary:
the request. This type is performed by using forbidden file
extensions along with file extension which is not
permitted by the application.

ISSN: 2231-5381 http://www.ijettjournal.org Page 344

 International Journal of Engineering Trends and Technology (IJETT) – Volume-42 Number-7 - December 2016

Steps: Add some trailing spaces or dots after the

Select an executable file (Test.exe) and rename it extension (say Test.php………) and upload the file
(Test.exe.aabbcc) with a file extension which the in file upload functionality of the application.
server or client does not understand. Vulnerability Reason:
This can also be done by intercepting the request Finding neutral characters after a filename such as
using a proxy tool and changing the values. trailing spaces and dots in Windows file system or
Upload this file/forward the request and observe dot and slash characters in a Linux file system are
the results. removed automatically. These characters at the end
Vulnerability Reason: of a filename will be removed automatically (e.g.
When last extension (in our example .aabbcc), is "file.asp ... ... . . .. ..", "file.asp ", or "file.asp.").
not specified in the list of mime-types known to
the web server, Test.exe.aabbcc will be interpreted M. Case 13 – Bypass blacklist using Null Byte
as Test.exe and will be executed. Summary:
This attack is possible by using NULL Byte in the
J. Case 10 – Bypass blacklist using uncommon allowed file extensions.
executable extensions Steps:
Summary: Select executable file (Test.exe) and rename it
Blacklisting can often be bypassed using (Test.exe%00.jpg).
uncommon executable extensions such as php3, Another way to add the NULL byte is by
php4, php5, shtml, phtml, cgi which are intercepting the request in a proxy tool.
understood by server. Observe if the file is uploaded successfully.
Steps: Vulnerability Reason:
Upload any server executable file in the file Web application will accept the file as jpg. Null
upload feature of the application. byte (0x00) is used as a string terminator. When
Vulnerability Reason: web server tries to read it stops at Test.exe as it
The vulnerability is possible since these file encounters a null byte and the file is treated as
extensions are default files of the server and are executable file.
accepted when they are uploaded. These extension
codes can be modified with malicious content. N. Case 14 – Bypass using embedded executable
extension in excel sheet
K. Case 11 – Bypass blacklist by changing case in Summary:
extension In this type we try to embed an executable file
Summary: within an excel file and upload it onto the server
Blacklisting is bypassed by changing a number of which allows .xls or .xlsx formats.
letters to their capital forms to bypass case Steps:
sensitive rules (e.g. "file.aSp" or "file.PHp3"). First we embed an executable file into the excel
Steps: file using the Object option from the toolbar.
Select any malicious file which is blacklisted by Now we write a small script/formula in the cell
the server (Test.php). such that the executable file embedded is executed
Change some letters in the extension to their as soon as the excel file is opened.
capital form (say Test.pHp or Test.PHp) and Thus an excel file is created where malicious file
upload the file. and code is written.
Vulnerability Reason: Upload this file and observe if the file was
This vulnerability occurs when validation applied uploaded successfully.
for filtering disallowed files is not proper. Security Vulnerability Reason:
checks made for filtering disallowed files should The attack is possible since there is no validation
be case insensitive. done at client side to check the body contents of
the attached file.
L. Case 12 – Bypass blacklist type by adding neutral
spaces O. Case 15 – Bypass using embedded executable
Summary: in pdf file
Blacklisting is bypassed by adding neutral spaces Summary:
or dots in Windows file system and slash and dots In this type we try to embed an executable file
in Unix file system. within a PDF file and upload it onto the server that
Steps: allows .pdf format.
Select any malicious file which is blacklisted by Steps:
the server (say Test.php). First we embed an executable file into a PDF file
using the path View>Comment>Annotations from
the toolbar.

ISSN: 2231-5381 http://www.ijettjournal.org Page 345

 International Journal of Engineering Trends and Technology (IJETT) – Volume-42 Number-7 - December 2016

From annotations, select attach file and place the  Do not place the .htaccess file in the same
cursor in the document and browse the file you directory where the uploaded files will be
want to attach. Attach an excel file with an stored. It should be placed in the parent
executable file embedded into it. directory.
Thus a pdf file is created where malicious excel  A typical .htaccess which allows only gif,
file is embedded. jpg, jpeg and png files should include the
Upload this file and observe if the file was following (adapt it for your own need). This
uploaded successfully. will also prevent double extension attacks.
Vulnerability Reason:
 The most important thing is to keep
The attack is possible since there is no validation
uploaded files in a location that can’t access
done at client side to check the body contents of
the attached file. though the Internet. This can be done either
by storing uploaded files outside of the web
P. Case 16 – Overwriting critical files root or configuring the web server to deny
Summary: access to the uploads directory.
In this type we try to overwrite critical files on the  Prevent overwriting of existing files (to
webserver such as .htaccess or web.config file. prevent the .htaccess overwrite attack).
Steps:  Don’t rely on client-side validation only,
Find the path of the .htaccess file onto the server since it is not enough. Ideally one should
using information gathering. have both server-side and client-side
Following line can be added in .htaccess file validation implemented. The application
before uploading: should use client- and server-side input
AddType application/x-httpd-php .gif validation to ensure evasion techniques have
Once the path is found, the above manipulated not been used to bypass the whitelist filter.
.htaccess file can be uploaded on the desired path  Set a pre-defined size and file name length.
using the file upload feature.  Files that are uploaded should be scanned by
Vulnerability Reason: antivirus software.
If the webserver allows to modify sensitive files  The application should not use the file name
such as .htaccess file or web.config file, we can
supplied by the user. Instead, the uploaded
upload files to modify how different files should
file should be renamed according to a
be executed on the server. The .htaccess file
predetermined convention. Thus, the
contains restrictions for a particular folder. Now
there are locations where the server allows the user attacker will encounter problems trying to
to upload and overwrite files. Using this feature of determine the name of the file in the
over writing an attacker can replace the .htaccess uploaded folder.
file with a manipulated one allowing permissions
VI. CONCLUSION
to execute scripts.
The above malicious line (AddType application/x-
In this paper we have highlighted the importance of
httpd-php .gif) explained would basically execute
application security and how users could be affected
every gif file inside the webserver as a PHP. So
by such data loss. Due to large user base of web
once an attacker uploads .htaccess file containing
applications it becomes necessary to make
that code, attacker can rename any malicious file
organizations aware of application security practices
as Test.gif which will be interpreted as a PHP file
to prevent these types of break-ins. We have
by the webserver.
demonstrated various ways to bypass the file upload
V. MITIGATION vulnerability using open source tools, along with their
mitigations. Security is not a one-time event due to
 The application should use a whitelist of which it insufficient to perform security analysis on
allowed file types. This list determines the the application just once. An application can meet the
types of files that can be uploaded, and security requirements only when all the stages of an
rejects all files that do not match approved application development cycle are analyzed securely
types. by developers and testers. This paper aims at
 Only allow authorized and authenticated providing awareness to apply security measures for
users to use the feature. file uploads at client and server side which will
 Serve fetched files from your application reduce the security testing cost by itself.
rather than directly via the web server.
ACKNOWLEDGEMENT
 Write to the file when you store it to include
a header that makes it non-executable. I offer my profound gratitude towards all the staff
 Define a .htaccess file that will only allow members of K. J. Somaiya College of Engineering,
access to files with allowed extensions.

ISSN: 2231-5381 http://www.ijettjournal.org Page 346

 International Journal of Engineering Trends and Technology (IJETT) – Volume-42 Number-7 - December 2016

Vidyavihar, Mumbai for providing me all academic

a s s i s t a n c e required to complete this paper.
I would like to thank my colleagues, who have
contributed to ease the understanding of this project
and this paper by giving their time and taking a keen
interest in making this a success.

REFERENCES

[1] X Lie and Y Xue. " A Survey on Web Application

Security." Vanderbilt University,
“http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.
434.7174&rep=rep1&type=pdf”.

[2] Web Application Security Statistics,

“http://projects.webappsec.org/w/page/13246989/WebApp
lication SecurityStatistics.”

[3] Ulfar Erlingsson, Benjamin Livshits, Yinglian Xie, "

Microsoft Reasearch", “http://research-
srv.microsoft.com/en-
us/um/people/livshits/papers/pdf/hotos07.pdf”.

[4] Ashwani Garg, Shekhar Singh. "A Review on Web

Application Security Vulnerabilities." International Journal
of Advanced Research in Computer Science and Software
Engineering (2013): 222-226.

[5] Rafique, Sajjad, Mamoona Humayun, Zartasha Gul, Ansar

Abbas, and Hasan Javed. "Systematic Review of Web
Application Security Vulnerabilities Detection Methods."
Journal of Computer and Communications 03.09 (2015):
28-40.

[6] B. Shaikh, "Web Server Security and Survey on Web

Application Security," International Journal on Recent and
Innovation Trends in Computing and Communication, vol.
2, no. 1, pp. 114–119, Jan. 2014.

[7] Jaiswal, Arunima, Gaurav Raj, and Dheerendra Singh.

"Security Testing of Web Applications: Issues and
Challenges." International Journal of Computer
Applications88.3 (2014): 26-32.

[8] OWASP Top 10-2013,

“https://www.owasp.org/index.php/Top_10_2013-Top_10.”

ISSN: 2231-5381 http://www.ijettjournal.org Page 347