Collected research
Breaking Down Multipart Parsers: File upload validation bypass
PHP, Busboy and Flask parsers disagree with the WAFs in front of them about one multipart/form-data body. Duplicated name or filename parameters, duplicated Content-Disposition headers, a broken CRLF between headers and body, unquoted filenames, a missing closing boundary (PHP accepts them) and filename*=UTF-8''backdoor%2ephp each let one side read a safe value and the other a dangerous one. HAProxy ACLs and AWS WAF parse only urlencoded bodies, so converting the request to multipart skips them.
Record
- Researcher
- @AndreaTheMiddle and Andrea Menin
- Published by
- Sicuranext Blog
- Date
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of @AndreaTheMiddle and Andrea Menin, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .