CWE-616: Incomplete Identification of Uploaded File… | Glexia
CWE-616 (Incomplete Identification of Uploaded File Variables (PHP)) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE…
Glexia's Take · Automated analysis
CWE-616: Incomplete Identification of Uploaded File Variables (PHP)
Incomplete Identification of Uploaded File Variables (PHP) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Confidentiality Integrity: Read Files or Directories Modify Files or Directories
Developer Pattern
CWE-616 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-616, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-616: Incomplete Identification of Uploaded File Variables (PHP)
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
These global variables could be overwritten by POST requests, cookies, or other methods of populating or overwriting these variables. This could be used to read or process arbitrary files by providing values such as "/etc/passwd".
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- As of 2006, the "four globals" method is probably in sharp decline, but older PHP applications could have this issue. In the "four globals" method, PHP sets the following 4 global variables (where "varname" is application-dependent):
- "The global $_FILES exists as of PHP 4.1.0 (Use $HTTP_POST_FILES instead if using an earlier version). These arrays will contain all the uploaded file information." ** note: 'userfile' is the field name from the web form; this can vary.
Remediation
- Architecture and Design: Use PHP 4 or later.
- Architecture and Design: If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES['userfile']))
- Implementation: For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.