Using .htaccess file to compromise loose ext control upload in php

Imagine this: You’ve just launched a new feature on your website allowing users to upload profile pictures. Everything seems fine until one day, your server is compromised, and malicious scripts are running wild. The culprit? A seemingly harmless .htaccess file lurking in your upload directory. This isn’t just a hypothetical scenario—it’s a common attack vector that exploits misconfigured .htaccess files and loose file extension controls in PHP. Let’s break down how this happens, how attackers exploit it, and most importantly, how you can protect your application.

What is the .htaccess File and Why Does It Matter?

The .htaccess file is a configuration file used by the Apache web server to control directory-level settings. It’s incredibly powerful, allowing you to manage redirects, set custom error pages, enable or disable directory indexing, and even define how specific file extensions are handled. For PHP applications, .htaccess can dictate which file extensions are treated as executable PHP scripts.

For example, you might use the following directive to tell Apache to treat files with extensions like .php5 or .phtml as PHP scripts:

AddType application/x-httpd-php .php .php5 .phtml

While this flexibility is convenient, it’s also a double-edged sword. Attackers can exploit misconfigured .htaccess files to execute arbitrary code, bypass security measures, or expose sensitive data. Before diving into the specifics, let’s talk about the security implications of allowing users to upload files to your server.

How Attackers Exploit .htaccess in Upload Directories

When you allow users to upload files, you’re essentially giving them a way to place content on your server. If your upload directory isn’t properly secured, attackers can upload malicious files and use .htaccess to weaponize them. Here are some common attack scenarios:

1. Executing Arbitrary Code

One of the most dangerous exploits involves using .htaccess to treat non-PHP files as PHP scripts. For example, an attacker could upload a file named malicious.jpg containing PHP code and then add the following directive to the upload directory’s .htaccess file:

AddType application/x-httpd-php .jpg

This tells Apache to process .jpg files as PHP scripts. The attacker can then execute their malicious code simply by accessing malicious.jpg via a browser.

2. Exposing Directory Contents

By default, Apache may block directory indexing, which prevents users from seeing a list of files in a directory. However, an attacker can override this setting by adding the following line to .htaccess: