Malicious File Upload Attack

How Malicious File Upload Attack Works

File upload functionality is a core feature of modern web applications: profile avatars, document attachments, CSV imports, firmware updates. Each upload endpoint is an opportunity for an attacker to place arbitrary content on the server. The attack succeeds when the application trusts the uploaded file without verifying that its actual content matches the expected type, that its name doesn't contain path traversal sequences, and that the storage location prevents execution. The gap between what the application assumes ("this is a harmless JPEG") and what the file actually is (a PHP web shell with a .jpg.php extension) is where the attack lives.

Real-World Examples

Impact & Risk Assessment

Malicious file upload is rated High because it provides a direct path from unauthenticated external access to code execution on the server. The immediate impact depends on the payload: web shells grant full interactive control over the server, cryptominers consume compute resources, ransomware encrypts data for extortion, and XSS payloads (via SVG/HTML) compromise end users. The blast radius extends far beyond the upload endpoint — once code execution is achieved, the attacker inherits the web server process's access to databases, internal services, cloud metadata endpoints, and mounted file systems. In cloud environments, this frequently enables lateral movement to other services via instance metadata credentials. The vulnerability is particularly insidious because file upload is a legitimate, expected feature — users and administrators don't perceive it as an attack surface until it's exploited.

How to Detect Malicious File Upload Attack

Implement multi-layer detection: (1) WAF rules inspecting upload requests for dangerous file extensions (.php, .jsp, .asp, .aspx, .phtml, .phar, .py, .cgi, .pl, .sh, .htaccess, .config, .shtml), double extensions (.php.jpg), and null byte sequences in filenames; (2) Content analysis: scan uploaded file content for script signatures (<?php, <%, <%@, <script, #!/bin, eval(, system(, exec() regardless of declared file type — a JPEG containing <?php is a polyglot attack; (3) File integrity monitoring on upload directories to detect web shells deposited via other attack vectors; (4) Behavioral monitoring: alert when the web server process spawns unexpected child processes (sh, cmd.exe, powershell) after a file upload, indicating web shell execution; (5) Antivirus/antimalware scanning of all uploaded files before storage; (6) Monitor access patterns to upload directories — legitimate files are accessed infrequently compared to web shells that receive repeated parameterized requests.

How to Prevent Malicious File Upload Attack

Apply defense in depth for every upload endpoint: (1) Validate file content, not just the extension or MIME type — use magic byte validation, image re-processing libraries (ImageMagick, GD, Sharp) that strip non-image data, and dedicated file type detection libraries (Apache Tika, python-magic, file-type for Node.js); (2) Rename uploaded files to random, non-guessable names with a server-enforced extension — never preserve the original filename; (3) Store uploads outside the web document root so they cannot be directly accessed via URL — serve them through a controller that sets Content-Disposition: attachment and a safe Content-Type; (4) Configure the web server to never execute scripts in the upload directory (remove PHP/CGI handlers, deny script execution in IIS); (5) Enforce strict file size limits and rate limiting on upload endpoints; (6) Use a Content Security Policy (CSP) to mitigate XSS from uploaded SVG/HTML files; (7) In cloud deployments, store uploads in object storage (S3, GCS, Azure Blob) with private ACLs and serve via signed URLs or a CDN — this completely eliminates server-side execution risk.

Code Examples

<?php
// VULNERABLE: Multiple validation failures
$target_dir = '/var/www/html/uploads/';
$target_file = $target_dir . basename($_FILES['file']['name']);

// FLAW 1: Trusting client-sent MIME type
$mime = $_FILES['file']['type'];  // Attacker controls this!
if ($mime == 'image/jpeg' || $mime == 'image/png') {

    // FLAW 2: Only checking extension (shell.php.jpg bypasses this)
    $ext = pathinfo($target_file, PATHINFO_EXTENSION);
    if (in_array($ext, ['jpg', 'png', 'gif'])) {

        // FLAW 3: Preserving original filename (allows path traversal)
        move_uploaded_file($_FILES['file']['tmp_name'], $target_file);
        echo "Upload successful: /uploads/" . basename($target_file);
    }
}

// Attacker uploads: shell.php with Content-Type: image/jpeg
// Or: shell.php.jpg on misconfigured Apache with AddHandler php-script .php
// Or: ../../../var/www/html/shell.php as the filename
?>

<?php
class SecureUploader {
    private string $storageDir;  // OUTSIDE document root
    private array $allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
    private int $maxSize = 5 * 1024 * 1024;  // 5 MB

    public function __construct(string $storageDir) {
        $this->storageDir = rtrim($storageDir, '/');
    }

    public function upload(array $file): array {
        // 1. Check for upload errors
        if ($file['error'] !== UPLOAD_ERR_OK) {
            throw new RuntimeException('Upload failed');
        }

        // 2. Enforce file size limit
        if ($file['size'] > $this->maxSize) {
            throw new RuntimeException('File too large');
        }

        // 3. Detect real MIME type from file content (NOT client header)
        $finfo = new finfo(FILEINFO_MIME_TYPE);
        $realMime = $finfo->file($file['tmp_name']);
        if (!in_array($realMime, $this->allowedTypes, true)) {
            throw new RuntimeException('Invalid file type: ' . $realMime);
        }

        // 4. Re-process image to strip any embedded code
        $image = @imagecreatefromstring(file_get_contents($file['tmp_name']));
        if ($image === false) {
            throw new RuntimeException('Invalid image data');
        }

        // 5. Generate random filename with server-enforced extension
        $ext = match($realMime) {
            'image/jpeg' => 'jpg',
            'image/png'  => 'png',
            'image/gif'  => 'gif',
        };
        $newName = bin2hex(random_bytes(16)) . '.' . $ext;
        $destPath = $this->storageDir . '/' . $newName;

        // 6. Save the re-processed image (strips any non-image data)
        match($realMime) {
            'image/jpeg' => imagejpeg($image, $destPath, 85),
            'image/png'  => imagepng($image, $destPath, 9),
            'image/gif'  => imagegif($image, $destPath),
        };
        imagedestroy($image);

        return ['id' => pathinfo($newName, PATHINFO_FILENAME), 'name' => $newName];
    }
}

// Serve files through a controller — never expose the storage directory
// GET /files/{id} → reads from storage dir, sets Content-Disposition: attachment
?>

Frequently Asked Questions

Related Attacks