You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Copying files with an unauthorized extension between server directories. In some apps the misconfiguration lead to different security issues(secrets exposure, RCE, etc.)
To Reproduce
Steps to reproduce the behavior:
Create 2 folders on filesystem
Manually create php file in one
Be sure that php file upload restricted
Be sure that you cant just copy and paste php files
Copy folder with php file to other folder
Check that folder copied with not allowed file php
Expected behavior
Message like "Unable to copy folder with not allowed file types"
Screenshots
Last version 2.1.65
Check if you can upload php files
Manually create php file on folder
Check if you can copy not allowed files on the same directory
Check if you can copy not allowed files on the other directory
Copy the entire folder to another one and check if the php file exists
Describe the bug
Copying files with an unauthorized extension between server directories. In some apps the misconfiguration lead to different security issues(secrets exposure, RCE, etc.)
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Message like "Unable to copy folder with not allowed file types"
Screenshots
Last version 2.1.65
![image](https://private-user-images.githubusercontent.com/67024514/336484066-32fbace4-a1c7-421e-b959-46e48e79ddb3.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1Nzc5MTQsIm5iZiI6MTcyNTU3NzYxNCwicGF0aCI6Ii82NzAyNDUxNC8zMzY0ODQwNjYtMzJmYmFjZTQtYTFjNy00MjFlLWI5NTktNDZlNDhlNzlkZGIzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA1VDIzMDY1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWNjZWY4ZjA3ODY2YjZlZDU5OGMyZDNlN2JiMjYwNTJhOWE4OTdmNzA2NTRjODc2NzU1YTgyYTc2MDMyYjhlNDkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.3tL1Gqz1ANCgbKUU2SgZWW5MSwEtV0UTEMYprfz7Ksw)
Check if you can upload php files
![image](https://private-user-images.githubusercontent.com/67024514/336484251-9a95842a-f4e7-4a32-be95-99092c944299.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1Nzc5MTQsIm5iZiI6MTcyNTU3NzYxNCwicGF0aCI6Ii82NzAyNDUxNC8zMzY0ODQyNTEtOWE5NTg0MmEtZjRlNy00YTMyLWJlOTUtOTkwOTJjOTQ0Mjk5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA1VDIzMDY1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTRlMmZhZjIxZTMxYzA5Y2M3YWZiNGMxMzQzMjc3YmMxNWZkNmU2YThiZWU5NTZjZjNkMWU2MDUzMTliNDI2ODAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.uZgnfjakK7UrCaAggqoF_wLEGFlg_rE_lzaJWeaDhtA)
Manually create php file on folder
![image](https://private-user-images.githubusercontent.com/67024514/336485059-5bbeab96-69ea-4dbe-9547-aa789ebf21d9.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1Nzc5MTQsIm5iZiI6MTcyNTU3NzYxNCwicGF0aCI6Ii82NzAyNDUxNC8zMzY0ODUwNTktNWJiZWFiOTYtNjllYS00ZGJlLTk1NDctYWE3ODllYmYyMWQ5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA1VDIzMDY1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTVhNTRkMWU0MGUzMzljYWQwZjc0M2NiMTcxZTY4YTA3MDRmZmRkOTIyMTZhNmU1NjgzM2E4Mzg5MDJlZjJkZmUmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.28DU0AkWek4ShkrA78mNJwcxWhrKys3HSEDfP3mLhlk)
![image](https://private-user-images.githubusercontent.com/67024514/336485137-66210ceb-efd1-4221-a54a-476e0c237349.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1Nzc5MTQsIm5iZiI6MTcyNTU3NzYxNCwicGF0aCI6Ii82NzAyNDUxNC8zMzY0ODUxMzctNjYyMTBjZWItZWZkMS00MjIxLWE1NGEtNDc2ZTBjMjM3MzQ5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA1VDIzMDY1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTExMjg3YjYxZjBlYzJmZWE2ZTFlZmI4NTU0Y2Q3M2VmNjljNjJlODIxNmU0Y2E2ZTQ4YjU5MzhkYWI1N2MxYTMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Inwx-e3EgfDj6FK1f3PRjMNJeABvnl14agVPIWbsqD4)
Check if you can copy not allowed files on the same directory
![image](https://private-user-images.githubusercontent.com/67024514/336485257-ea2921f5-0c2f-410f-8a76-dee7f3d7941b.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1Nzc5MTQsIm5iZiI6MTcyNTU3NzYxNCwicGF0aCI6Ii82NzAyNDUxNC8zMzY0ODUyNTctZWEyOTIxZjUtMGMyZi00MTBmLThhNzYtZGVlN2YzZDc5NDFiLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA1VDIzMDY1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWM2MzQ2ZjY1NDdmNzBjMjk2YTlhMTFkNzNmNmZmYzg3Y2MyY2E2MjMwOTUyNjk4ZDcyMzE4NDljYmYzNTExYTYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.NWSvpBzUEJw-nlW_hr5TVBmhplX_2fjf36kvQXIiAiU)
Check if you can copy not allowed files on the other directory
![image](https://private-user-images.githubusercontent.com/67024514/336485395-eaa6bfce-7f88-4779-9820-ed72a1789d23.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1Nzc5MTQsIm5iZiI6MTcyNTU3NzYxNCwicGF0aCI6Ii82NzAyNDUxNC8zMzY0ODUzOTUtZWFhNmJmY2UtN2Y4OC00Nzc5LTk4MjAtZWQ3MmExNzg5ZDIzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA1VDIzMDY1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWY5Njk3NmFlYzIwZWYxOTNhMDY1MDIwNjlmMTM1ZTc1YmVmYjVhM2E2YWI1YTRiMGJkZDJiZGZkZDhjNWI4NWQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.nVeRssrrN_7in-PsY9yTH7G2k549fkM3W8aQuG7N6hk)
Copy the entire folder to another one and check if the php file exists
![image](https://private-user-images.githubusercontent.com/67024514/336485577-9331bfdb-8701-4716-a6a3-9f99cf895559.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU1Nzc5MTQsIm5iZiI6MTcyNTU3NzYxNCwicGF0aCI6Ii82NzAyNDUxNC8zMzY0ODU1NzctOTMzMWJmZGItODcwMS00NzE2LWE2YTMtOWY5OWNmODk1NTU5LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA1VDIzMDY1NFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTlmMzU5NzFlNDExZTU1M2ZjN2UzNDcxMTA2MjE0ODMwZmEwM2ViNTllNzU1OGMzZDZlMzU1MjUyOWFlYTUwMmImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Suw7H4FMV3Wiu33dnrX0GLQyT91cbKVt670TxNfvJT4)
Desktop:
The text was updated successfully, but these errors were encountered: