search

huacnlee / carrierwave-aliyun

阿里云 OSS Ruby 上传组件，基于 Carrierwave
https://huacnlee.com/carrierwave-aliyun/
197 stars 93 forks source link

#security# Attacker upload extension whitelist file with content type `text/html` 文件头安全漏洞 #81

Closed RicottaZhang closed 2 years ago

RicottaZhang commented 2 years ago

https://github.com/huacnlee/carrierwave-aliyun/blob/dc8de78885a53ebb9505b1c2b028b6e15b6a55d2/lib/carrierwave/storage/aliyun.rb#L9

通过该行代码，覆盖了OSS原生的自动识别content-type功能。 攻击者通过修改上传数据的content-type上传了后缀为.png的白名单后缀文件，简单利用curl即可。

--data-raw $'------WebKitFormBoundaryKYyQo1yApqB1pdPN\r\nContent-Disposition: form-data; name="image_file"; filename="attack.png"\r\nContent-Type: text/html\r\n\r\n\r\n------WebKitFormBoundaryKYyQo1yApqB1pdPN--\r\n' \
huacnlee commented 2 years ago

https://github.com/carrierwaveuploader/carrierwave#securing-uploads