PHP - Path Manipulation / Input Validation

Question

I ran a Gray Box Assessment test for an application i developed and i have some vulnerabilities, specific a Path Manipulation in the Input Validation Category.

I have in my code:

if (move_uploaded_file($_FILES["file"]["tmp_name"],"contacts_load/" . $fileName)) {
    if ($import = fopen ("contacts_load/" . $fileName,"r")) {

and:

unlink("contacts_load/" . $fileName);

The problem is in contacts_load/.

Below you are going to find some information about this:

Description: Allowing user input to control paths used in filesystem operations could enable an attacker to access or modify otherwise protected system resources.

Specific Scenario:

Path manipulation errors occur when the following two conditions are met:

An attacker can specify a path used in an operation on the filesystem.

By specifying the resource, the attacker gains a capability that would not otherwise be permitted.

For example, the program may give the attacker the ability to overwrite the specified file or run with a configuration controlled by the attacker.

How can i prevent the path manipulation for this specific scenario?

From here: $fileName = Date("YmdHis")."_".$_FILES["file"]["name"]; but the issue is in the path (contacts_load/). — JuanSedano
– JuanSedano, Commented Dec 9, 2014 at 20:53
$_FILES["file"]["name"] already contains the basename of the filename provided in the request. — Gumbo
– Gumbo, Commented Dec 9, 2014 at 20:55
The issue is with $_FILES["file"]["tmp_name"]. It's user supplied and is a path/file. — AbraCadaver
– AbraCadaver, Commented Dec 9, 2014 at 21:00
You are right, i was confuse, the issue is with the filename, because the attacker could provide a file name such as "../../tomcat/conf/server.xml" and cause a problem in the file system. — JuanSedano
– JuanSedano, Commented Dec 9, 2014 at 21:03

Community · Accepted Answer · 2017-05-23 12:08:12Z

1

There is no problem with contacts_load/. The user cannot modify it.

I do recommend you sanitize $_FILES["file"]["name"] though. This answer should be helpful.

edited May 23, 2017 at 12:08

CommunityBot

11 silver badge

answered Dec 9, 2014 at 20:53

Mooseman

18.9k14 gold badges74 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

JuanSedano Over a year ago

The issue is in the file path, not in the filename.

Mooseman Over a year ago

@JuanSedano The user cannot control it. What concerns do you have?

JuanSedano Over a year ago

You are right, i was confuse, the issue is with the filename, because the attacker could provide a file name such as "../../tomcat/conf/server.xml" and cause a problem in the file system.

britter · Accepted Answer · 2014-12-09 20:55:15Z

1

.htaccess file?

# Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
</FilesMatch>

# Don't show directory listings for URLs which map to a directory.
Options -Indexes

answered Dec 9, 2014 at 20:55

britter

1376 bronze badges

Collectives™ on Stack Overflow

PHP - Path Manipulation / Input Validation

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related