Security issue?
php, security
Solution
MIME type checks will not solve the GIFAR issue. 2009's JREs are already patched, but if you want to solve the issue you can either
- Serve your images from a different domain
- Run a server side code to check if an image contains a valid JAR, like mentioned here
Anything else (short of denying the file to any Java enabled browser with an old enough JRE) may fail on specific cases.
Also remember that to perform a good attack with this technique your server infrastructure would have to be somewhat open (the fact that a request comes from the same domain doesn't mean that you should give any information it asks for.)
Problem
I am writing a small PHP application and I am not sure whether I have a security issue. So this is what the application does: - the user can upload either image files (png, gif, jpg, jpeg, tiff and a few others) or zip files I check for mime-type and extension and if it's not an allowed I don't allow the upload (this is not the part I am worried about). Now once uploaded I rename the file to a unique hash and store in a folder outside root access. The user can now access the file through a short URL. I make the file accessible by setting the right mime-type for the header and then I just use readfile(). My question is whether the exploit where a jar file is included inside the image file works here? I am serving the image as a pure image. If it does what are ways to prevent this? Thanks.