What is file upload abuse?¶
The practical answer¶
File upload abuse occurs when an application’s upload function is used to place unauthorised, dangerous or misleading content onto a server or service.
The key evidential caution¶
The dangerous assumption is that every suspicious uploaded file was executed.
It may not be.
An offender may upload:
Key points¶
- malware
- a web shell
- phishing content
- stolen data
- illegal content
- scripts
- oversized files
- altered documents
What investigators should establish¶
Investigators should establish:
Key points¶
- which account or session uploaded the file
- the original filename
- server-side path
- hash and size
- content type
- upload time
- application response
- whether the file became publicly reachable
- whether it was opened, processed or executed
- what later activity followed
Applications may rename, scan, transform or store uploads outside the web root.
A successful upload response does not prove the file could be executed.
Evidential limits¶
Likewise, the absence of the original filename does not mean the upload failed.
Preserve the original file, application metadata, storage-object identifier, access logs and any process activity.
Do not open suspected malicious uploads on an ordinary investigative device.
Upload controls may inspect filename, extension, content type, file signature, size and destination. Preserve which control accepted or rejected the file. An upload that is stored safely outside executable locations presents a different risk from one that becomes directly reachable and executable.
Uploads may also be transformed by image processors, document converters or malware scanners. Preserve the original and stored versions where available, because the application may have altered or neutralised the content before storage.
Operational takeaway¶
Prove upload, storage, reachability and execution separately, and preserve the file and application records before removal changes the evidence.