what are the flaws , one must care in file upload

Question

I have a Linux server , i am having an upload image in my website , the users who register can upload his images , when he logs in to his profile he can see his image , also he can get the url link of his image , so the images are uploaded to the server in the WWW/img directory I am checking the extension of file in php and only allowing (.png ,.gif,.jpg) files

BUT i don't know why some one uploaded a gif image and deleted all my files , i got the image uploaded by the user since we are having RAID the contents of the image was some thing like .......

function vUMmFr($MkUOmK){$MkUOmK=gzinflate(base64_decode($MkUOmK));for($i=0;$i<strlen($MkUOmK);$i++){$MkUOmK[$i]=chr(ord($MkUOmK[$i])-1)}return $MkUOmK}eval(vUMmFr("7b1pe+M2sij8ved55j............

what is this , how this happened , how all the files got deleted ? what language is this , how can i protect the files from deleting ..

Answer 1

You probably have a very badly written file upload handler, something that blindly trusts what the user provides, puts the files with the original user-provided filename into a publicly accessible directory within your webroot. In short, your file upload script was the equivalent of a big flashing neon sign blinding "HACK ME!".

e.g., something like this:

<?php

if ($_FILES['file']['type'] == 'image/gif') {
    move_uploaded_files($_FILES['file']['tmp_name'], '/some/path/in/your/docroot/' . $_FILES['file']['name']);
}

Things that are wrong here:

1. no checking for errors - file uploads can fail for any number of reasons, and not checking for errors is a very bad thing
2. The ['type'] field is user-provided data - a malicious user can forge that mime type with ease. They can quite easily upload 'somescript.php' but tag it as an image.
3. Blindly using the ['name'] parameter as part of the path you're storing the file in. Again, that is under the control over the user. One malicious user and your server flushes itself down the toilet.
4. Storing the file in the docroot. So now you're allowing ANY file of ANY type with ANY name to be uploaded. If it's a script, and the location of the file is reachable by URL, you're now allowing remote users to execute ANY code they want on your server.

In short, when dealing with file uploads, you treat the file as a ready-to-explode nuclear bomb that's 0.001 seconds away from detonation. You do not store it with the original file name. You do not store it anywhere the user can get at it. You do not store it with a predictable filename. You do server-side validation on the file. You lift up the file's skirts and look under the hood to make sure it's what it's supposed to be... and even then you still assume it's lying.