File Upload basic Vulnerabilities

These vulnerabilities arise when the server fails to enforce restrictions on the files uploaded to its system, such as name, type, content, or size.

Link for non-members users

File Upload Vulnerabilities

File Upload Filters

1. Extension Validation: validates the file extension
2. File Type Filtering: validate the Content-Typeheader

• MIME validation: MIME (Multipurpose Internet Mail Extension) types are used as an identifier for files — originally when transferred as attachments over email, but now also when files are being transferred over HTTP(S). The MIME type for a file upload is attached in the header of the request
• Magic Number validation: Magic numbers are the more accurate way of determining the contents of a file; although, they are by no means impossible to fake. The “magic number” of a file is a string of bytes at the very beginning of the file content which identifies the content. For example, a PNG file would have these bytes at the very top of the file: 89 50 4E 47 0D 0A 1A 0A.

3. File Length Filtering

4. File Name Filtering

5. File Content Filtering

Content-Type header is used to tell the client or the server which data is sent. each content-type value is divided…