Local Vulnerability Lab Configuration

Testing exploit techniques against production infrastructure is illegal and unethical. To safely analyze file upload vulnerabilities, a localized sandbox environment is required. Using a lightweight cloud instance with Docker ensures rapid deployment without environmental conflicts.

docker pull squ1rrel/vulnerable-uploads
docker run -d -p 9090:80 squ1rrel/vulnerable-uploads

After initialization, configure the host firewall to permit traffic on the designated port. Access the interface via http://[SERVER_IP]:9090. If the application returns a missing directory error during upload attempts, manually create the required storage folder inside the container:

mkdir /var/www/html/storage
chmod 777 /var/www/html/storage

File Upload Exploit Patterns

Vulnerable applications often fail to enforce robust validation across different execution layers. The following patterns highlight common bypass methodologies.

Client-Side Validation Bypass

When validation relies solely on client-side JavaScript, the restriction is trivially circumvented. By disabling the validation script in the browser developer tools or intercepting the HTTP request with a proxy tool, an attacker can alter the payload extension from .jpg to .php before it reaches the server.

MIME Type Manipulation

Backend checks that exclusively rely on the Content-Type header are vulnerable to spoofing. An intercepted upload request carrying application/octet-stream can be modified to image/jpeg, satisfying the server's MIME verification while still delivering a malicious script payload.

Obsolete Extension Execution

Restricting uploads based on a hardcoded blocklist of extensions like .php misses legacy interpreter configurations. Older Apache setups might still execute .php4 or .phtml files using the PHP engine. Uploading a payload with an unblocked legacy extension allows script execution.

Apache Configuration Injection

If .htaccess files are permitted, an attacker can upload a configuration file that forces the server to interpret arbitrary file types as executable scripts.

AddType application/x-httpd-php .txt

Once this directive is active, any subsequent .txt file uploaded to that directory will be processed as PHP, completely bypassing extension-based filters.

Case Alteration and Trailing Characters

Poorly written validation logic that does not normalize strings can be bypassed using mixed case extensions (e.g., .PhP) or appending trailing whitespace/null bytes (e.g., .php%20). Operating systems may strip these invalid characters, resulting in a functional .php file on disk.

File Inclusion Exploit

Even if uploaded images are strictly validated, a separate Local File Inclusion (LFI) flaw can execute embedded payloads. An image can be appended with a script payload.

<?php
$payload_path = $_REQUEST['target'];
if (isset($payload_path)) {
    require_once($payload_path);
}
?>

By navigating to the inclusion endpoint and passing the uploaded image path as a parameter, the server parses the embedded script within the image data.

Image Re-rendering Persistence

Some applications process uploaded images through functions like imagecreatefromgif() to strip malicious metadata. However, GIF format re-rendering often preserves specific pixel blocks unchanged. By comparing the binary structure of the original and re-rendered images, an attacker can identify stable injection points to embed PHP payloads that survive the sanitization process.

Race Condition Execution

Applications that save uploaded files before validating and deleting them expose a brief execution window. By automating high-frequency concurrent requests to the uploaded script path, an attacker can trigger script execution during the milliseconds it exists on disk before deletion.

EdgeOne Mitigation Strategies

When application-level code auditing is impractical, perimeter defenses provide essential protection. EdgeOne offers configurable security layers to neutralize upload-based attacks without modifying the backend application.

Strict Extension Enforcement

EdgeOne's managed rules identify malicious upload attempts based on file extensions. By default, these rules might operate in an observation mode. To actively block web shell uploads, navigate to the Security > Web Protection > Managed Rules section and disable global observation mode, shifting the policy to enforcement. If standard enforcement misses specific payloads, adjust the rule set severity from loose to strict or normal to ensure comprehensive interception of sensitive extensions.

Content Payload Inspection

Bypassing extension filters by disguising scripts as legitimate media files (e.g., a .jpg containing phpinfo()) is thwarted by content inspection rules. EdgeOne analyzes the payload data regardless of the declared extension or MIME type, intercepting requests that match script signatures. This defense successfully blocks both standalone pseudo-files and embedded script fragments within actual image binaries.

Upload Frequency Throttling

Race condition exploits and resource exhaustion attacks rely on rapid, repetitive uploads. EdgeOne mitigates this through rate limiting. Instead of applying site-wide restrictions, implement targeted QPS limits on specific upload API endpoints (e.g., /api/v1/upload). Setting a constraint such as 5 requests per second per client prevents automated concurrent bombardment while preserving normal user functionality.

Payload Size Constraints

Preventing excessively large file submissions preserves server network IO and computing resources. Within the Site Acceleration configuration, establish differentiated rules for upload paths. Define a maximum payload size (e.g., 2MB) and bind a custom 413 response page. This ensures that oversized submissions are cleanly rejected at the edge, presenting a stable user interface rather than a disrupted connection.