Type of vulnerability: Server-Side

Chances to find: Common; File upload vulnerabilities are part of “Insecure Design” ranked #4 in the “OWASP Top-10 Vulnerabilities“

What is a file upload vulnerability ?

occurs when an application improperly handles or validates user-uploaded files, allowing an attacker to upload malicious files to the serve

Impact of file upload vulnerabilities :

• [ ] Remote code execution
• [ ] Dos( if application not validating file size or number of files uploaded)
• [ ] Phishing page

How to prevent file upload vulnerabilities ?

• [ ] implement allow list containing only the file types which are really necessary for the proper functioning of the web app
• [ ] Restrict file size to certain limit
• [ ] Create new file names for all uploaded files or remove all potentially dangerous characters (such as control characters, special characters and Unicode characters)

Resource

https://book.hacktricks.xyz/pentesting-web/file-upload