made a management system for government departments, and later asked us to rectify the hidden security problems. One of the requirements is that the file name uploaded by the user cannot contain special characters.
is it really possible to attack the server through uploaded files?
there is no doubt that "arbitrary file upload" is a type of vulnerability, and it is necessary to limit the uploaded files.
uploaded files that contain malicious code and are executed at the back end will often cause attackers to get WebShell.
you might think, what does this have to do with the file name? Yes, there is.
first of all, the code contained in the file name may also be executed.
second, special characters in the file name may invalidate your file upload check, such as CVE-2015-2348.
Respondent:
YvesX @ Chuangyu Front end
for example, send a ".. / test.jsp" file to the jsp site?