File Upload Vulnerabilities: When the Check Misses the Point

What it is#

An upload handler that checks the wrong thing, or checks the right thing and stops there, is how a file upload turns into code execution or a stored attack against whoever opens the file later.

The labs here#

• PixelFrame gallery upload RCE: the extension is blacklisted, not allow-listed, and the blacklist misses one. .phtml isn't on the blocked list even though .php, .php3, .php4 and .php5 are, and most servers happily execute it as PHP anyway.
• VaultDocs export polyglot: the extension check here is actually fine. The bug is what happens when the file is served back: it's returned inline with a Content-Type taken from something the attacker controls, so a file that looks like a harmless document can be served as text/html and run as a page in the victim's browser.