Phoenix Network Forums

I`m have wrote a CMS to my site ,with a very hard login part ,but I`m always prepared for it to be hacked somehow ,so I made sure that even if someone can get passed my login then he cannot do much damage.But now I`m planning on making a file upload part to upload imagees ,wich is very dangerous ,cause most hackers will try to upload php scripts ,altough this would be available to only who gets passed the login ,it can be a good weapon against my site ,so I was thinking of a double file check first the form would check that if it`s *.png ,*.jpg or *.gif ,but secondly the processor script would check again ,is there any suggestions on how can I make this more restrictive?

Hi!

U can simply use gd library to check if uploaded file is image or not.

DjDarkman wrote:I was thinking of a double file check first the form would check that if it`s *.png ,*.jpg or *.gif

Just make sure that you're not checking the name of the file.

Also, I think I would also have a double-check style going on ... like this maybe:
1. Check to see if it's a binary file (check with -B operator in Perl)

2.a. If it's not binary (text-only), either delete it straight away, or move it to some "holding bay" area and send yourself an e-mail about having a new script someone wanted to try against you. Make sure to change the file permission to something like 0400 (read by owner) so you don't accidentally execute it

2.b. If it is a binary file, you still have no idea what it is. It might be a horrible compiled C++ CGI that's supposed to "rm -rf ~"; you have to check to see whether it's an image or not ...

Just one possible way follows ...
If you "look" through the file and find a string that contains "glibc," "gcc," "libstdc++," "ELF," "GLIBC," "libgcc," the name of any distro ('less'ing through a small C++ program I compiled, I plainly see: "GCC: (GNU) 3.3.5 (Debian 1:3.3.5-12)"), the name of any platform (i386, ...), it's compiled code, not an image. You can either try a sandbox and run it (for curiousity), or just move it/remove execution permission from it.

There are probably easier ways in which to do this, so if anyone has any links to neat Perl modules or the like please speak up :P

lost wrote:U can simply use gd library to check if uploaded file is image or not.

Care to actually be bothered to explain it, though? >.>

No no no, you just have to check the header mime content type of the uploaded file...

If you use PHP for your CMS you can use the 'mime_content_type' function.

mime_content_type($your_file) returns if $your_file is for example a Jpeg image : image/jpeg,
if it is a gif : image/gif, if it is a script : text/plain (a script is a text file), etc...

or the worst solution :

If your server is under Linux you can launch after the upload the system command 'file' to determine what type of file was uploaded (bad solution)...

Note : the system command 'file' and 'mime_content_type()' php function have the same mechanism, they find a file type by using a magic.mime file.

Good luck

bugalinux wrote:No no no, you just have to check the header mime content type of the uploaded file...

If you use PHP for your CMS you can use the 'mime_content_type' function.

mime_content_type($your_file) returns if $your_file is for example a Jpeg image : image/jpeg,
if it is a gif : image/gif, if it is a script : text/plain (a script is a text file), etc...

or the worst solution :

If your server is under Linux you can launch after the upload the system command 'file' to determine what type of file was uploaded (bad solution)...

Note : the system command 'file' and 'mime_content_type()' php function have the same mechanism, they find a file type by using a magic.mime file.

Good luck

This looks good ,I want to use only php functions.Any other suggestions are welcome.

yeah, testing it with mime_content_type() is the right solution. Never, if at all possible, pay any heed to file extentions as they can easily lie. A good example was the recent WMF exploit for IE.

Btw, it's kind of nit-picking, but scripts actually have their own mime type (a python script is text/python and an executable python script is text/x-python). However, light-weight mime detection systems are often lazy and fall back to text/plain.

My concern is that it must be image only so I`ll use the whitelist mode ,python scripts are harmeless if they cannot be executed the most dangerous are php scripts.

These three funtions do the same thing, all of them check if the uploaded file (imgfile) is a image.
But IsValidImage and IsValidImage0, chek if the image have the type we want.

I think that these function are secure, if you don't think so, please notify me.

Code: Select all

//functions by x86anonymous

function IsImage($image){// IsImage($imgfile);
      return getimagesize($image) ? true : false;
}

function IsValidImage($image){// IsValidImage($imgfile);
      $img_types = array(IMAGETYPE_GIF,  IMAGETYPE_JPEG, IMAGETYPE_PNG);
      return in_array(exif_imagetype($image), $img_types);
//Note: You can add more valid types:  http://pt.php.net/manual/en/function.exif-imagetype.php (Imagetype Constants)
}

function IsValidImage0($type){// IsValidImage0($imgfile_type);
      $img_types = array('image/gif', 'image/jpg', 'image/jpeg', 'image/pjpeg', 'image/png');
      return in_array($type, $img_types);
}
/*
when you upload a file, is posted more information about the file:
>temporary filename (pointer): $imgfile
>original filename           : $imgfile_name
>mime-type of uploaded file  : $imgfile_type
*/

echo "IsImage($imgfile) = ";
echo IsImage($imgfile) ? "true<br />" : "false<br />";  // check if it is a image
echo "IsValidImage($imgfile) = ";
echo IsValidImage($imgfile) ? "true<br />" : "false<br />"; // check if it is a valid image type
echo "IsValidImage0($imgfile_type) = ";
echo IsValidImage0($imgfile_type) ? "true<br />" : "false<br />"; // check if it is a valid image type