Detection of Web Server Polyglot File Upload Bypass

This detection brief addresses the risk of polyglot file creation on Linux systems, a technique where attackers craft files that appear to be one data type based on header bytes (e.g., JPEG or PNG) but utilize a script extension (e.g., .php or .jsp) to bypass file upload validation. By successfully uploading a polyglot file, an attacker can bypass static validation checks that only verify the file header. If the web server subsequently processes the file or the directory is configured to execute scripts, the attacker can trigger embedded malicious code, resulting in a persistent web shell or remote command execution. This behavior is commonly associated with attackers exploiting public-facing applications and serves as a method for establishing persistent access or facilitating lateral movement. Defenders should monitor web server processes that create files with mismatched type signatures and extensions.

Attack Chain

1. Attacker identifies a vulnerable file upload endpoint on a target web application.
2. Attacker crafts a malicious polyglot file, such as a JPEG containing hidden PHP code in the metadata or data payload.
3. Attacker sends an HTTP POST request containing the polyglot file to the server.
4. Web application security filter validates the file header bytes (e.g., JPEG Magic Bytes) and permits the upload.
5. The web server process writes the file to the local disk with an executable extension like .php.
6. Attacker triggers the execution of the file by navigating to its URI via a browser or HTTP client.
7. The web server interprets the embedded malicious code, resulting in code execution under the web server's context.
8. Attacker leverages the resulting web shell for persistence, exfiltration, or further lateral movement within the environment.

Impact

Successful exploitation allows for unauthorized code execution, persistence, and potential escalation of privileges on the affected host. This may lead to the exfiltration of sensitive data, disruption of service, or further compromise of the internal network, depending on the permissions of the web server account.

Recommendation

Prioritize the implementation of advanced file monitoring on all internet-facing Linux web servers to detect content/extension mismatches.

• Configure the Elastic Defend integration to set 'linux.advanced.events.populate_file_data' to 'true' to capture file extension and header information.
• Deploy the provided detection logic to identify processes commonly used in web hosting (e.g., nginx, apache2, php-fpm) that create files with mismatching extension/header pairs.
• Inspect files flagged by the detection logic for embedded script blocks or obfuscated code, and perform static analysis to confirm malicious intent.
• Harden application upload workflows by validating full file content (rather than relying on headers), renaming files upon upload, and storing uploaded media in directories configured to disable script execution.