CWE-434: Unrestricted Upload of File with Dangerous Type

Description:
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Affected languages: ASP.NET, PHP, Not Language-Specific
Affected technologies: Web Server, AI/ML
Parent weaknesses: CWE-669, CWE-669

Consequences:
  - Integrity: Execute Unauthorized Code or Commands

Detection methods:
  - Dynamic Analysis with Automated Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Automated Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           

Mitigations:
  - [Architecture and Design] Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.[REF-422] [REF-423]
  - [Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
  - [Architecture and Design] Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically. [REF-423]
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe

Demonstrative examples:
The following code intends to allow a user to upload a picture to the web server. The HTML code that drives the form on the user end has an input field of type "file".
Once submitted, the form above sends the file to upload_picture.php on the web server. PHP stores the file in a temporary location until it is retrieved (or discarded) by the server side code. In this example, the file is moved to a more permanent pictures/ directory.
<form action="upload_picture.php" method="post" enctype="multipart/form-data"> 
                      Choose a file to upload: <input type="file" name="filename"/> <br/> <input type="submit" name="submit" value="Submit"/> 
                      </form>
// Define the target location where the picture being 
                      
                      
         

The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.
When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.
<form action="FileUploadServlet" method="post" enctype="multipart/form-data"> 
                      Choose a file to upload: <input type="file" name="filename"/> <br/> <input type="submit" name="submit" value="Submit"/> 
                      </form>
public class FileUploadServlet extends HttpServlet { 
                      
                         ... 
  

Real-world examples:
  - CVE-2023-5227: PHP-based FAQ management app does not check the MIME type for uploaded images
  - CVE-2001-0901: Web-based mail product stores ".shtml" attachments that could contain SSI
  - CVE-2002-1841: PHP upload does not restrict file types
  - CVE-2005-1868: upload and execution of .php file
  - CVE-2005-1881: upload file with dangerous extension