Unrestricted file upload persisted under client-supplied name

ID

vbnet.path_resolution.dangerous_file_upload

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Path Resolution

Language

VB.NET

Description

An uploaded file is persisted to disk using its client-supplied file name. An attacker who controls the name (and therefore the extension) can save a file with a dangerous type such as a web shell (e.g. "shell.aspx"), leading to remote code execution. Do not trust the uploaded FileName: store the file under a server-generated name (Guid.NewGuid / Path.GetRandomFileName) and validate the extension against an allow-list.

Rationale

An uploaded file is persisted to disk using its client-supplied file name. An attacker who controls the name (and therefore the extension) can save a file with a dangerous type such as a web shell (e.g. "shell.aspx"), leading to remote code execution. Do not trust the uploaded FileName: store the file under a server-generated name (Guid.NewGuid / Path.GetRandomFileName) and validate the extension against an allow-list.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub SaveAsCombineFileName(ByVal file As HttpPostedFile, dir As String)
    ' VULNERABLE: Unrestricted file upload persisted under client-supplied name
    file.SaveAs(Path.Combine(dir, file.FileName))
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References