Web shell upload via Content-Type restriction bypass

Description

This lab contains a vulnerable image upload function. It attempts to prevent users from uploading unexpected file types, but relies on checking user-controllable input to verify this.

Reproduction and proof of concept

  1. Log in and upload an image as your avatar, then go back to your account page.

  2. In Burp, go to Proxy -> HTTP history and notice that your image was fetched using a GET request to /files/avatars/<YOUR-IMAGE>. Send this request to Burp Repeater.

  3. On your system, create a file called exploit.php, containing a script for fetching the contents of Carlos’s secret. For example:

 <?php echo file_get_contents('/home/carlos/secret'); ?>

  1. Attempt to upload this script as your avatar.

Sorry, file type application/x-php is not allowed Only image/jpeg and image/png are allowed Sorry, there was an error uploading your file.

� Back to My Account

The response indicates that you are only allowed to upload files with the MIME type image/jpeg or image/png.

  1. In Burp, go back to the proxy history and find the POST /my-account/avatar request that was used to submit the file upload. Send this to Burp Repeater.

  2. In Burp Repeater, go to the tab containing the POST /my-account/avatar request. In the part of the message body related to your file, change the specified Content-Type to image/jpeg.

  3. Send the request.

File upload

The response indicates that your file was successfully uploaded.

  1. Switch to the other Repeater tab containing the GET /files/avatars/<YOUR-IMAGE> request. In the path, replace the name of your image file with exploit.php and send the request. Observe that Carlos’s secret was returned in the response.

  2. Submit the secret to solve the lab.

Exploitability

An attacker will need to log in to wiener:peter; upload a basic PHP web shell and use it to exfiltrate the contents of the file /home/carlos/secret; and then enter this secret using the button provided in the lab banner.