Is this script vulnerable to shell command bypass? - php

Question

I'm using this script to receive base 64 encoded images from an Android app. I was wondering if there's any way possible to bypass a PHP shell command inside a POST request and get it to work in the server, for example, sending the command shell encoded and a name like "shell.php", "shell.php%0delete0". According to the script, everything will be saved as .png, so I'd say it's safe, but maybe I'm wrong and the script is actually vulnerable to shell command uploads.
<?php
header('charset=utf-8');
if($_SERVER['REQUEST_METHOD'] == 'POST') {
if(isset($_POST['image']) && isset($_POST['name'])) {
$image = $_POST['image'];
$name = $_POST['name'];
file_put_contents("/var/www/html/admigas/android/uploads/$name".strval(date('_Ym')).".png",base64_decode($image));
echo "Success";
} else {
echo "Wrong params";
}
} else {
echo "Nothing to do";
}
?>

Answer 1

So, let's look at the code step-by-step. My comments are preceded by #:
<?php
header('charset=utf-8');
if($_SERVER['REQUEST_METHOD'] == 'POST') {
if(isset($_POST['image']) && isset($_POST['name'])) {
# This is provided by the user:
$image = $_POST['image'];
# This is provided by the user:
$name = $_POST['name'];
# Where does $name come from? User input, of course!
file_put_contents("/var/www/html/admigas/android/uploads/$name".strval(date('_Ym')).".png",base64_decode($image));
echo "Success";
} else {
echo "Wrong params";
}
} else {
echo "Nothing to do";
}
Consequently, sending name=../../../../reverse-shell.php%00 with a base64-encoded payload will allow an attacker to upload an arbitrary file (in this case, PHP code), and probably execute it on the subsequent PHP request.
Solution (presented in diff format):
- $name = $_POST['name'];
+ $name = preg_replace('#[^A-Za-z0-9\-_]#', '', $_POST['name']);
You definitely want to remove any non-URL-safe characters to prevent attacks. You may want to totally rethink your strategy, of course.