Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support optional compatibility to LF as line break #61

Open
suikabreaker opened this issue Jan 11, 2022 · 0 comments · May be fixed by #64
Open

Support optional compatibility to LF as line break #61

suikabreaker opened this issue Jan 11, 2022 · 0 comments · May be fixed by #64

Comments

@suikabreaker
Copy link
Contributor

suikabreaker commented Jan 11, 2022

Many (if not all) mainstream web servers, Apache(mod_upload) and Nginx(upload module) for instance are compatible to request use LF as line break:

https://github.com/Austinb/nginx-upload-module/blob/2.2/ngx_http_upload_module.c#L4123
https://github.com/Austinb/nginx-upload-module/blob/2.2/ngx_http_upload_module.c#L4051
http://apache.webthing.com/mod_upload/mod_upload.c L304

Would it be necessary for the resty-upload module to support this too? Maybe an optional feature and closed by default?

To illustrate when it matters, if a WAF may want to filter multipart forms and use lua-resty-upload, where a malicious request can bypass its check for headers:

POST /submit.php HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6GpaBUxso7BnIrnA
Headers-Dont-Matter: it doesnt matter

------WebKitFormBoundary6GpaBUxso7BnIrnA
Content-Type: text/plain
Content-Disposition: form-data; name="something"; filename="doesnt_matter"

[LF rather than CRLF this line]
------WebKitFormBoundary6GpaBUxso7BnIrnA[LF rather than CRLF this line]
Content-Disposition: form-data; name="webshell.php"

malicious script here
------WebKitFormBoundary6GpaBUxso7BnIrnA--

from WAF's point of view, below is a single line:

[LF rather than CRLF this line]
------WebKitFormBoundary6GpaBUxso7BnIrnA[LF rather than CRLF this line]
Content-Disposition: form-data; name="webshell.php"

therefore the boundary is missing and the second uploaded file(including its headers) is seen as part of the first file's body, and the protected server still sees it as two files.

We can make up more methods to bypass WAF based on this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant