Arbitrary File Upload Vulnerability in Backend

# Arbitrary File Upload Vulnerability in Backend

## Rep

![image-20241221204450917](https://github.com/saqy2/picx-images-hosting/raw/master/image-20241221204450917.13lu92p5rr.webp)

In the article management -> publish arti

Click the file to upload, first choose any image, then intercept the data packet using

![image-20241221204810027](https://github.com/saqy2/picx-images-hosting/raw/master/image-20241221204810027.361mx4nqt4.webp)

Modify the data and the file name arbitrarily, and the file can be uploaded to the local se

## Analysis:

The interface that handles

```java
src/main/java/com/tarzan/cms/modules/admin/controller/common/UploadController.java
@ResponseBody
@PostMapping("/upload")
public UploadResponse upload(@RequestParam(value = "file", required = false) MultipartFile file) {
    return ossService.upload(file);
}
```

This calls `ossService.upload`, which is located in:

```
src/main/java/com/tarzan/cms/modules/admin/service/common/OssService.java
```

![image-20241221205251034](https://github.com/saqy2/picx-images-hosting/raw/master/code.9rjgo5v6tl.webp)

As seen in the code, it only checks if the file is null. If it is null, an exception is thrown; otherwise, it proceeds to store the file without any content validation, resulting in an arbitrary file upload vulnerab

泰山AI/泰山内容管理系统 tarzan-cms

内容风险标识

评论 (0)

泰山AI/泰山内容管理系统 tarzan-cms .gitee-modal { width: 500px !important; }

内容风险标识