Question

I want to have an upload system on my website, where users can only upload images.
These images will be resized by PHP directly on upload, so the original image will not be stored.
Do I still have to worry about scripts like php, etc. executing from malicious images?

Answer 1

You still have the following attack vectors to consider:

1. The uploaded image will be stored for a certain time on the server and could be used for evil if there are bugs in your application.

2. Any byte trash uploaded as the image might trigger bugs in your resize code that reads the uploaded image, so it is important to stay up to date with this software or library.

Apart from that, the generated image should be considered safe.

Update:

Uploading images with PHP always results in a temporary file being created somewhere, possibly in an unknown “temporary file directory” location that everyone else on a shared host is also using. This file has a file name and possibly the malicious content. Although the filename is randomly generated, an attacker might be able to guess it and try to use it. On the other hand, you cannot protect yourself from this built-in php mechanism other than not to use unsafe include/require statements, because usually an attack requires a) getting evil code on your server and b) executing it.

Steps against it seem obvious: Configure a dedicated upload directory for your php. Secure it against code execution on the filesystem level by applying appropriate rights and restrictions. Don’t mess with the random name generation. Keep this directory out of DOCUMENT_ROOT.

The second attack might be that an attacker tricks your code into reading a non-uploaded nonpublic file with the intent to reveal it’s content. So it is a very good idea to check if the filename inside $_FILES really is an uploaded file before proceeding.