Falhas do tipo CWE-434

3.244 resultados

Upload irrestrito de arquivo com tipo perigoso

A aplicação aceita upload de arquivos sem validar adequadamente o tipo ou extensão, permitindo que um atacante envie executáveis, scripts ou outros arquivos maliciosos que serão armazenados ou executados no servidor. O risco aumenta se o arquivo for salvo em diretório acessível pela web ou em local onde será processado automaticamente.

Exemplo

Um sistema de upload de 'fotos de perfil' verifica apenas o tamanho do arquivo, mas não valida a extensão. Um atacante envia um arquivo .php disfarçado de imagem; se salvo em /uploads/ acessível via web, ele consegue executar código PHP no servidor ao acessar a URL direta.

Como mitigar

Valide extensões contra uma lista branca (whitelist) de tipos permitidos, verifique a assinatura do arquivo (magic bytes) e não confie apenas no Content-Type do cliente. Armazene uploads fora do diretório web ou configure o servidor para não executar scripts no diretório de uploads.

CVE-2012-10050CRITICALCuteFlow <= 2.11.2 Arbitrary File Upload RCEEPSS 2.0%CVE-2023-29930HIGHAn issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via EPSS 2.0%CVE-2024-34833CRITICALSourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settings" page. An unautheEPSS 2.0%CVE-2021-32538CRITICALARTWARE CMS - Unrestricted Upload of FileEPSS 2.0%CVE-2021-41566CRITICALTad TadTools - Arbitrary File UploadEPSS 2.0%CVE-2022-41705CRITICALBadaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because thEPSS 2.0%CVE-2023-46808CRITICALAn file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. SuccessEPSS 2.0%CVE-2012-10026CRITICALWordPress Plugin Asset-Manager <= 2.0 PHP File UploadEPSS 2.0%CVE-2023-27602CRITICALApache Linkis publicsercice module unrestricted upload of fileEPSS 2.0%CVE-2026-32475CRITICALWordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerabilityEPSS 2.0%CVE-2023-26852HIGHAn arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by upEPSS 2.0%CVE-2012-10044CRITICALMobileCartly 1.0 savepage.php Arbitrary File CreationEPSS 2.0%CVE-2026-25099HIGHRemote Code Execution via Unrestricted File Upload in BluditEPSS 2.0%CVE-2015-1784—In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the weEPSS 2.0%CVE-2014-125119HIGHWinRAR < 5.00 Filename Spoofing RCEEPSS 2.0%CVE-2023-45554CRITICALFile Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter frEPSS 2.0%CVE-2021-24493—Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File UploadEPSS 2.0%CVE-2023-5490MEDIUMByzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform userattestation.php unrestricted uploadEPSS 2.0%CVE-2023-5493MEDIUMByzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform web.php unrestricted uploadEPSS 2.0%CVE-2023-5489MEDIUMByzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform uploadfile.php unrestricted uploadEPSS 2.0%