CWE Top 25 — #10
Unrestricted Upload of File with Dangerous Type
CWE-434Accepting arbitrary file uploads without validating type, size, or content, letting an attacker upload a .php, .jsp, or malicious binary.
GateTest coverage
Not directly covered today. GateTest has no dedicated rule for this class yet — it depends on application logic or runtime behaviour a static pattern cannot see. The remediation below says which adjacent GateTest checks apply.
Example
app.post('/upload', upload.single('file'), (req, res) => { fs.writeFileSync('./public/' + req.file.originalname, req.file.buffer) })How to fix it
Validate MIME type AND file magic-bytes (don't trust the extension). Store outside the web root. Rename to a hash on save. Set a strict size limit. Never serve uploads from a directory where they can be executed. GateTest has no upload-specific rule today; crossFileTaint catches the adjacent path-traversal shape when the uploaded filename reaches a filesystem sink.
Frequently asked questions
What is CWE-434 (Unrestricted Upload of File with Dangerous Type)?
Accepting arbitrary file uploads without validating type, size, or content, letting an attacker upload a .php, .jsp, or malicious binary.
How do I fix unrestricted upload of file with dangerous type?
Validate MIME type AND file magic-bytes (don't trust the extension). Store outside the web root. Rename to a hash on save. Set a strict size limit. Never serve uploads from a directory where they can be executed. GateTest has no upload-specific rule today; crossFileTaint catches the adjacent path-traversal shape when the uploaded filename reaches a filesystem sink.
Does GateTest detect CWE-434?
Not with a dedicated rule today. Unrestricted Upload of File with Dangerous Type depends on application logic or runtime behaviour that a static pattern cannot see on its own. Validate MIME type AND file magic-bytes (don't trust the extension). Store outside the web root. Rename to a hash on save. Set a strict size limit. Never serve uploads from a directory where they can be executed. GateTest has no upload-specific rule today; crossFileTaint catches the adjacent path-traversal shape when the uploaded filename reaches a filesystem sink.
What rank is Unrestricted Upload of File with Dangerous Type in the CWE Top 25?
Unrestricted Upload of File with Dangerous Type is ranked #10 in the MITRE 2023 CWE Top 25 Most Dangerous Software Weaknesses list. The ranking reflects both prevalence (how often it appears in real CVEs) and severity (the typical impact when it's exploited).