Remote code execution via web shell upload — PortSwigger Academy

From Unrestricted File Upload to Remote Code Execution

Introduction

In this lab, I explored how an unrestricted file upload vulnerability can lead to Remote Code Execution (RCE) when an application fails to properly validate and handle user-uploaded files.

The target application provides an avatar upload functionality. However, the application does not perform adequate validation on uploaded files, allowing a server-side script to be uploaded and executed.

This write-up documents my approach, the exploitation process, the underlying security issue, and possible mitigations.

Lab Objective

The objective of this lab was to:

Upload a simple PHP web shell and use it to retrieve the contents of a sensitive file located on the server.

The lab provides a test account, allowing the vulnerability to be explored in a controlled environment.

1. Identifying the Attack Surface

After authenticating, I navigated to the My Account page.

The page contained an avatar upload feature:

Avatar → Choose File → Upload

At first glance, this appears to be a normal image upload functionality.

However, file upload functionality is an important security boundary because uploaded files can potentially be interpreted by the server.

2. Testing the File Upload

The lab description indicated that uploaded files were not properly validated.

Instead of uploading a normal image, I tested whether the application would accept a PHP file.

I created a minimal PHP web shell specifically for the controlled lab environment.

The purpose of the web shell was to determine whether the uploaded PHP file would be interpreted and executed by the server.

I then uploaded the file through the avatar upload functionality.

The application responded with a message confirming that the file had been successfully uploaded.

3. Locating the Uploaded File

The upload response revealed the location where the file had been stored.

This was an important finding because the uploaded file was placed in a web-accessible directory.

The general attack chain was:

File Upload
     ↓
Server stores uploaded PHP file
     ↓
Uploaded file is accessible through the web
     ↓
Server interprets the PHP code
     ↓
Remote Code Execution

File Upload
     ↓
Server stores uploaded PHP file
     ↓
Uploaded file is accessible through the web
     ↓
Server interprets the PHP code
     ↓
Remote Code Execution

4. Confirming Remote Code Execution

I accessed the uploaded PHP file through its URL.

Instead of being downloaded or rejected as an invalid image, the server interpreted the PHP code and returned its output.

This confirmed that arbitrary server-side code execution was possible through the file upload functionality.

At this point, the vulnerability had escalated from an unrestricted file upload to Remote Code Execution (RCE).

5. Accessing the Target File

With code execution confirmed, I used the web shell to access the file specified in the lab objective.

The server successfully returned the file contents, demonstrating that the uploaded web shell could interact with the server's filesystem.

For this write-up, I am intentionally not publishing the actual secret value.

The important result was that the application allowed an attacker-controlled file to execute with the privileges of the web application.

6. Root Cause

The vulnerability exists because the application does not properly validate uploaded files.

Several security controls are missing or insufficient:

• No effective allowlist for permitted file types
• Uploaded server-side scripts are accepted
• Uploaded files are stored in a web-accessible location
• Server-side code can be executed from the upload directory

The combination of these weaknesses makes the upload functionality particularly dangerous.

7. Impact

An unrestricted file upload vulnerability can have serious consequences.

Depending on the application's configuration and privileges, successful exploitation may allow an attacker to:

• Execute arbitrary server-side code
• Read sensitive files
• Access application data
• Modify files
• Potentially compromise the application or underlying server

This demonstrates why file upload functionality should always be treated as a security-sensitive feature.

8. How to Prevent This Vulnerability

Several defensive measures can significantly reduce the risk.

1. Use an Allowlist

Only allow file types that are actually required by the application.

2. Validate File Content

Do not rely solely on the filename or extension. Validate the file's actual content and file signature.

3. Store Uploads Outside the Web Root

Uploaded files should ideally be stored in a location that cannot be directly executed or accessed through the web server.

4. Disable Script Execution

If uploads must remain web-accessible, configure the server so that uploaded files cannot be interpreted as server-side scripts.

5. Rename Uploaded Files

Generate server-side filenames rather than preserving user-controlled filenames.

6. Apply Least Privilege

The web application should run with the minimum permissions necessary to perform its intended functions.

Key Takeaways

This lab demonstrated a simple but important attack chain:

Unrestricted File Upload
          ↓
Upload Server-Side Script
          ↓
Web-Accessible File
          ↓
Code Execution
          ↓
Remote Code Execution
          ↓
Access Sensitive Data

Unrestricted File Upload
          ↓
Upload Server-Side Script
          ↓
Web-Accessible File
          ↓
Code Execution
          ↓
Remote Code Execution
          ↓
Access Sensitive Data

The biggest takeaway for me was that a seemingly harmless feature such as an avatar upload can become a critical vulnerability when file validation, storage, and server configuration are not properly secured.

This exercise also reinforced the importance of thinking beyond individual vulnerabilities and understanding how multiple application behaviors can combine into a much more serious security impact.

Conclusion

The Remote Code Execution via Web Shell Upload lab was a useful hands-on exercise for understanding the relationship between unrestricted file uploads and RCE.

It reinforced several important web security concepts, particularly secure file handling, server-side validation, execution boundaries, and least-privilege principles.

I'm looking forward to continuing with more challenging labs and strengthening my practical web application security skills.

Platform: PortSwigger Web Security Academy Topic: Unrestricted File Upload Impact: Remote Code Execution (RCE) Difficulty: Apprentice