File upload functionalities are a common feature in modern web applications, but they can also become a significant security risk if not implemented correctly. Vulnerabilities like missing MIME-type validation and double extension exploits can lead to serious breaches, including remote code execution, XSS attacks, and user deception. This guide walks you through identifying, demonstrating, and mitigating these issues.

Common File Upload Vulnerabilities

1. Missing MIME-Type Validation

When applications fail to validate the file’s MIME type, attackers can upload harmful files disguised as legitimate ones. For instance, a `.php` script might be uploaded with a `.jpg` extension and executed on the server.

2. Double Extension Exploits

Attackers can manipulate file names by adding multiple extensions, such as `file.jpg.exe` or `image.png.aspx`. This can bypass extension validation and trick the server or users into treating the file differently.

3. Weak Storage Practices

Uploaded files stored in web-accessible directories without processing or sanitization can expose sensitive data or serve as entry points for malicious activity.

—

How to Identify File Upload Vulnerabilities

1. Test MIME-Type Validation
   – Upload files with incorrect MIME types and observe if they are accepted.
   – Example: Upload a `.txt` file renamed to `.jpg` and check if the system processes it as an image.
2. Simulate a Double Extension Exploit
   – Prepare a file with multiple extensions, such as `script.png.exe`.
   – Upload the file and check if the system validates only one extension or executes the file.
3. Inspect File Accessibility
   – Determine where the files are stored. If they are in a publicly accessible directory, access their URL to see if they execute or reveal sensitive data.

—

Demo: Proving the Vulnerability

Case 1: MIME-Type Validation

1. Create a file named `test.jpg` with malicious content, such as JavaScript or code in a supported server-side language (e.g., `.aspx` for .NET applications).

   <script>alert('Vulnerable!');</script>

2. Upload the file and access its URL. If the script runs, it demonstrates the lack of validation.

Case 2: Double Extension

1. Prepare a file named `image.jpg.exe` or `photo.png.html` with executable or script content.
2. Upload the file and check if it bypasses the validation and can be executed or downloaded deceptively.

Best Practices for Securing File Uploads

1. Validate File Extensions

Only allow specific extensions:

var allowedExtensions = new[] { ".jpg", ".png", ".pdf" };
var fileExtension = Path.GetExtension(uploadedFile.FileName).ToLower();
if (!allowedExtensions.Contains(fileExtension))
{
    throw new InvalidOperationException("Invalid file extension.");
}

2. Validate MIME Types

Cross-check the file’s MIME type with the expected types:

var allowedMimeTypes = new[] { "image/jpeg", "image/png" };
if (!allowedMimeTypes.Contains(uploadedFile.ContentType))
{
    throw new InvalidOperationException("Invalid MIME type.");
}

3. Reject Double Extensions

Ensure files with multiple extensions are not accepted:

if (uploadedFile.FileName.Split('.').Length > 2)
{
    throw new InvalidOperationException("Double extensions are not allowed.");
}

4. Rename Files

Rename uploaded files to prevent attackers from exploiting file names:

var safeFileName = Path.GetRandomFileName() + Path.GetExtension(uploadedFile.FileName);

5. Secure File Storage

Store uploaded files outside the web root to prevent direct access.

—

Conclusion

File upload vulnerabilities can lead to severe security breaches if left unchecked. By understanding common exploits, demonstrating their risks, and implementing best practices, you can significantly improve your application’s security. Always combine multiple validation techniques, sanitize file names, and secure file storage to mitigate risks effectively.

Have questions or need help implementing these strategies? Share your scenario in the comments below!