Unrestricted file upload in a web application refers to a security vulnerability where the application allows users to upload files without proper validation and controls. This can lead to serious security risks, such as:

• Malware Uploads: Attackers may upload malicious files, including scripts that can be executed on the server.
• File Type Exploitation: Uploading files with dangerous extensions (e.g., .php, .exe) which can be executed on the server (or by other users).
• Path Traversal Attacks: Attackers might upload files in directories they shouldn’t have access to, potentially overwriting important files or uploading files to paths that can be executed later.
• Denial of Service: Uploading very large files can consume excessive server resources, leading to a denial of service.

Remediation

• Allow only specific file types and validate them both client-side and server-side.
• Check file contents to ensure they match the expected type.
• Set a maximum file size to prevent resource exhaustion.
• Remove harmful characters and prevent directory traversal.
• Store files outside the web root and use randomised filenames.
• Ensure only authorised users can upload and access files.
• Use antivirus software to scan uploaded files.
• Log file upload activities and monitor for suspicious behaviour.

Metadata

• Severity: medium
• Slug: unrestricted-file-upload

CWEs

• 434: Unrestricted Upload of File with Dangerous Type

OWASP

• A04:2021: Insecure Design