Malicious Image Upload Leading to Code Execution

import magic
import struct
from PIL import Image, ExifTags
import re

class SecureImageValidator:
    def __init__(self):
        self.allowed_formats = ['JPEG', 'PNG', 'GIF', 'BMP']
        self.max_dimensions = (10000, 10000)
        self.max_file_size = 10 * 1024 * 1024  # 10MB
        
    def validate_image_comprehensively(self, file_path):
        """Multi-layer image validation"""
        
        # 1. File size check
        file_size = os.path.getsize(file_path)
        if file_size > self.max_file_size:
            raise ValueError(f"File too large: {file_size} bytes")
        
        # 2. Magic bytes validation
        with open(file_path, 'rb') as f:
            header = f.read(32)
        
        # Verify magic bytes match expected format
        if not self.validate_magic_bytes(header):
            raise ValueError("Invalid file signature")
        
        # 3. MIME type detection from content
        mime_type = magic.from_file(file_path, mime=True)
        allowed_mimes = ['image/jpeg', 'image/png', 'image/gif', 'image/bmp']
        if mime_type not in allowed_mimes:
            raise ValueError(f"Invalid MIME type: {mime_type}")
        
        # 4. PIL validation and format verification
        try:
            with Image.open(file_path) as img:
                # Verify format
                if img.format not in self.allowed_formats:
                    raise ValueError(f"Unsupported format: {img.format}")
                
                # Check dimensions
                if (img.width > self.max_dimensions[0] or 
                    img.height > self.max_dimensions[1]):
                    raise ValueError("Image dimensions too large")
                
                # Verify the image by attempting to load it completely
                img.verify()
        except Exception as e:
            raise ValueError(f"Invalid image file: {e}")
        
        # 5. Scan for embedded malicious content
        self.scan_for_malicious_content(file_path)
        
        # 6. Validate and sanitize metadata
        self.validate_metadata(file_path)
        
        return True
    
    def validate_magic_bytes(self, header):
        """Validate file magic bytes"""
        magic_bytes = {
            b'\xff\xd8\xff': 'JPEG',
            b'\x89PNG\r\n\x1a\n': 'PNG',
            b'GIF87a': 'GIF',
            b'GIF89a': 'GIF',
            b'BM': 'BMP'
        }
        
        for magic, format_type in magic_bytes.items():
            if header.startswith(magic):
                return True
        return False
    
    def scan_for_malicious_content(self, file_path):
        """Scan file content for malicious patterns"""
        with open(file_path, 'rb') as f:
            content = f.read()
        
        # Convert to string for pattern matching
        content_str = content.decode('utf-8', errors='ignore')
        
        malicious_patterns = [
            r'<\?php',
            r'<script[^>]*>',
            r'<%[^>]*%>',
            r'\$\{[^}]*\}',
            r'eval\s*\(',
            r'exec\s*\(',
            r'system\s*\(',
            r'shell_exec\s*\(',
            r'passthru\s*\(',
            r'javascript:',
            r'vbscript:'
        ]
        
        for pattern in malicious_patterns:
            if re.search(pattern, content_str, re.IGNORECASE):
                raise ValueError(f"Malicious content detected: {pattern}")
    
    def validate_metadata(self, file_path):
        """Validate and sanitize image metadata"""
        try:
            with Image.open(file_path) as img:
                if hasattr(img, '_getexif') and img._getexif():
                    exif = img._getexif()
                    
                    for tag_id, value in exif.items():
                        if isinstance(value, str):
                            # Check for malicious content in metadata
                            if any(pattern in value.lower() for pattern in 
                                   ['<script', '<?php', 'javascript:', '<iframe']):
                                raise ValueError("Malicious content in metadata")
        except Exception:
            # If EXIF reading fails, it's not necessarily an error
            pass

<?php
class SecureImageProcessor {
    private $allowedFormats = [IMAGETYPE_JPEG, IMAGETYPE_PNG, IMAGETYPE_GIF];
    private $maxWidth = 5000;
    private $maxHeight = 5000;
    private $jpegQuality = 85;
    
    public function processAndSanitizeImage($inputPath, $outputPath) {
        // 1. Validate image type
        $imageInfo = getimagesize($inputPath);
        if ($imageInfo === false) {
            throw new Exception('Invalid image file');
        }
        
        $imageType = $imageInfo[2];
        if (!in_array($imageType, $this->allowedFormats)) {
            throw new Exception('Unsupported image format');
        }
        
        // 2. Check dimensions
        if ($imageInfo[0] > $this->maxWidth || $imageInfo[1] > $this->maxHeight) {
            throw new Exception('Image dimensions too large');
        }
        
        // 3. Create image resource (this validates the image structure)
        $sourceImage = $this->createImageResource($inputPath, $imageType);
        if ($sourceImage === false) {
            throw new Exception('Failed to create image resource');
        }
        
        // 4. Create clean image
        $width = imagesx($sourceImage);
        $height = imagesy($sourceImage);
        
        $cleanImage = imagecreatetruecolor($width, $height);
        
        // Handle transparency for PNG and GIF
        if ($imageType === IMAGETYPE_PNG || $imageType === IMAGETYPE_GIF) {
            $this->preserveTransparency($cleanImage, $sourceImage, $imageType);
        }
        
        // Copy pixel data (this strips all metadata and embedded content)
        imagecopy($cleanImage, $sourceImage, 0, 0, 0, 0, $width, $height);
        
        // 5. Save clean image
        $this->saveCleanImage($cleanImage, $outputPath, $imageType);
        
        // 6. Cleanup
        imagedestroy($sourceImage);
        imagedestroy($cleanImage);
        
        return $outputPath;
    }
    
    private function createImageResource($imagePath, $imageType) {
        switch ($imageType) {
            case IMAGETYPE_JPEG:
                return imagecreatefromjpeg($imagePath);
            case IMAGETYPE_PNG:
                return imagecreatefrompng($imagePath);
            case IMAGETYPE_GIF:
                return imagecreatefromgif($imagePath);
            default:
                return false;
        }
    }
    
    private function preserveTransparency($cleanImage, $sourceImage, $imageType) {
        if ($imageType === IMAGETYPE_PNG) {
            imagealphablending($cleanImage, false);
            imagesavealpha($cleanImage, true);
            $transparent = imagecolorallocatealpha($cleanImage, 255, 255, 255, 127);
            imagefill($cleanImage, 0, 0, $transparent);
        } elseif ($imageType === IMAGETYPE_GIF) {
            $transparentIndex = imagecolortransparent($sourceImage);
            if ($transparentIndex >= 0) {
                $transparentColor = imagecolorsforindex($sourceImage, $transparentIndex);
                $transparentNew = imagecolorallocate(
                    $cleanImage,
                    $transparentColor['red'],
                    $transparentColor['green'],
                    $transparentColor['blue']
                );
                imagefill($cleanImage, 0, 0, $transparentNew);
                imagecolortransparent($cleanImage, $transparentNew);
            }
        }
    }
    
    private function saveCleanImage($image, $outputPath, $imageType) {
        switch ($imageType) {
            case IMAGETYPE_JPEG:
                return imagejpeg($image, $outputPath, $this->jpegQuality);
            case IMAGETYPE_PNG:
                return imagepng($image, $outputPath, 6);
            case IMAGETYPE_GIF:
                return imagegif($image, $outputPath);
            default:
                return false;
        }
    }
    
    public function generateSecureFilename($originalName) {
        $extension = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));
        $allowedExts = ['jpg', 'jpeg', 'png', 'gif'];
        
        if (!in_array($extension, $allowedExts)) {
            $extension = 'jpg'; // Default to JPEG
        }
        
        $timestamp = date('Y-m-d_H-i-s');
        $random = bin2hex(random_bytes(8));
        
        return "{$timestamp}_{$random}.{$extension}";
    }
}

// Node.js secure image serving implementation
const express = require('express');
const path = require('path');
const fs = require('fs');
const sharp = require('sharp');
const crypto = require('crypto');

class SecureImageServer {
    constructor() {
        this.imageDir = path.resolve(__dirname, '../secure_images'); // Outside web root
        this.allowedFormats = ['jpeg', 'png', 'gif', 'webp'];
        this.maxFileSize = 10 * 1024 * 1024; // 10MB
        
        this.ensureImageDirectory();
    }
    
    ensureImageDirectory() {
        if (!fs.existsSync(this.imageDir)) {
            fs.mkdirSync(this.imageDir, { recursive: true, mode: 0o755 });
        }
    }
    
    async processUploadedImage(file) {
        // Generate secure filename
        const secureFilename = this.generateSecureFilename(file.originalname);
        const tempPath = path.join(this.imageDir, 'temp_' + secureFilename);
        const finalPath = path.join(this.imageDir, secureFilename);
        
        try {
            // Save uploaded file temporarily
            fs.writeFileSync(tempPath, file.buffer);
            
            // Process and sanitize with Sharp
            const image = sharp(tempPath);
            const metadata = await image.metadata();
            
            // Validate format
            if (!this.allowedFormats.includes(metadata.format)) {
                throw new Error(`Unsupported format: ${metadata.format}`);
            }
            
            // Validate dimensions
            if (metadata.width > 8000 || metadata.height > 8000) {
                throw new Error('Image dimensions too large');
            }
            
            // Re-encode image to strip metadata and normalize
            await image
                .removeProfile() // Remove all metadata
                .jpeg({ quality: 85, mozjpeg: true })
                .toFile(finalPath);
            
            // Clean up temp file
            fs.unlinkSync(tempPath);
            
            return {
                filename: secureFilename,
                path: finalPath,
                size: fs.statSync(finalPath).size,
                format: 'jpeg', // Always convert to JPEG
                hash: await this.calculateFileHash(finalPath)
            };
            
        } catch (error) {
            // Clean up on error
            if (fs.existsSync(tempPath)) {
                fs.unlinkSync(tempPath);
            }
            if (fs.existsSync(finalPath)) {
                fs.unlinkSync(finalPath);
            }
            throw error;
        }
    }
    
    generateSecureFilename(originalName) {
        const timestamp = Date.now();
        const random = crypto.randomBytes(16).toString('hex');
        return `${timestamp}_${random}.jpg`; // Always use .jpg extension
    }
    
    async calculateFileHash(filePath) {
        const fileBuffer = fs.readFileSync(filePath);
        return crypto.createHash('sha256').update(fileBuffer).digest('hex');
    }
    
    serveImage(req, res, filename) {
        const imagePath = path.join(this.imageDir, filename);
        
        // Validate filename
        if (!this.isValidFilename(filename)) {
            return res.status(400).json({ error: 'Invalid filename' });
        }
        
        // Check if file exists
        if (!fs.existsSync(imagePath)) {
            return res.status(404).json({ error: 'Image not found' });
        }
        
        // Verify it's within the image directory
        const resolvedPath = path.resolve(imagePath);
        if (!resolvedPath.startsWith(this.imageDir)) {
            return res.status(403).json({ error: 'Access denied' });
        }
        
        // Set security headers
        res.setHeader('Content-Type', 'image/jpeg');
        res.setHeader('X-Content-Type-Options', 'nosniff');
        res.setHeader('Content-Disposition', 'inline');
        res.setHeader('Cache-Control', 'public, max-age=31536000'); // 1 year cache
        
        // Serve the file
        res.sendFile(resolvedPath);
    }
    
    isValidFilename(filename) {
        // Only allow our generated filename pattern
        const pattern = /^\d+_[a-f0-9]{32}\.jpg$/;
        return pattern.test(filename);
    }
    
    // Optional: Create thumbnails
    async createThumbnail(originalPath, size = 150) {
        const filename = path.basename(originalPath, '.jpg');
        const thumbnailPath = path.join(this.imageDir, `thumb_${size}_${filename}.jpg`);
        
        await sharp(originalPath)
            .resize(size, size, {
                fit: 'cover',
                position: 'center'
            })
            .jpeg({ quality: 80 })
            .toFile(thumbnailPath);
        
        return thumbnailPath;
    }
}

// Usage in Express app
const imageServer = new SecureImageServer();

// Upload endpoint
app.post('/upload-image', upload.single('image'), async (req, res) => {
    try {
        if (!req.file) {
            return res.status(400).json({ error: 'No image provided' });
        }
        
        const result = await imageServer.processUploadedImage(req.file);
        
        res.json({
            message: 'Image uploaded successfully',
            filename: result.filename,
            size: result.size,
            hash: result.hash
        });
        
    } catch (error) {
        console.error('Image upload error:', error.message);
        res.status(400).json({ error: error.message });
    }
});

// Serve endpoint
app.get('/image/:filename', (req, res) => {
    imageServer.serveImage(req, res, req.params.filename);
});

class ImageSecurityMonitor {
    constructor() {
        this.suspiciousPatterns = {
            polyglot: [
                /\xff\xd8\xff.*<\?php/s,
                /\x89PNG.*<script/s,
                /GIF8.*javascript:/s
            ],
            metadata: [
                /<script[^>]*>/i,
                /<iframe[^>]*>/i,
                /javascript:/i,
                /data:text\/html/i,
                /<\?php/i
            ],
            filestructure: [
                /PLTE.*<\?php/s,
                /tEXt.*eval\(/s,
                /iTXt.*system\(/s
            ]
        };
        
        this.uploadAttempts = new Map();
        this.maxAttempts = 5;
        this.timeWindow = 300000; // 5 minutes
    }
    
    analyzeUpload(file, userInfo) {
        const analysis = {
            timestamp: new Date(),
            filename: file.originalname,
            size: file.size,
            mimetype: file.mimetype,
            user: userInfo,
            threats: [],
            riskLevel: 'low'
        };
        
        // Check for polyglot patterns
        this.checkForPolyglot(file.buffer, analysis);
        
        // Analyze filename patterns
        this.analyzeFilename(file.originalname, analysis);
        
        // Check upload frequency
        this.checkUploadFrequency(userInfo, analysis);
        
        // Calculate risk level
        this.calculateRiskLevel(analysis);
        
        // Log analysis
        this.logAnalysis(analysis);
        
        // Take action if high risk
        if (analysis.riskLevel === 'high') {
            this.handleHighRiskUpload(analysis);
        }
        
        return analysis;
    }
    
    checkForPolyglot(buffer, analysis) {
        const content = buffer.toString('binary');
        
        for (const [category, patterns] of Object.entries(this.suspiciousPatterns)) {
            for (const pattern of patterns) {
                if (pattern.test(content)) {
                    analysis.threats.push({
                        type: 'polyglot',
                        category: category,
                        pattern: pattern.toString(),
                        severity: 'high'
                    });
                }
            }
        }
    }
    
    analyzeFilename(filename, analysis) {
        const suspiciousFilenames = [
            /\.(php|asp|jsp|pl|py|cgi)\.(jpg|png|gif)$/i,
            /\.jpg\.(php|asp|jsp)$/i,
            /shell|backdoor|webshell/i,
            /\.\./,
            /[\x00-\x1f]/
        ];
        
        for (const pattern of suspiciousFilenames) {
            if (pattern.test(filename)) {
                analysis.threats.push({
                    type: 'suspicious_filename',
                    pattern: pattern.toString(),
                    severity: 'medium'
                });
            }
        }
    }
    
    checkUploadFrequency(userInfo, analysis) {
        const userId = userInfo.id || userInfo.ip;
        const now = Date.now();
        
        if (!this.uploadAttempts.has(userId)) {
            this.uploadAttempts.set(userId, []);
        }
        
        const attempts = this.uploadAttempts.get(userId);
        
        // Remove old attempts
        const recentAttempts = attempts.filter(
            attempt => now - attempt < this.timeWindow
        );
        
        recentAttempts.push(now);
        this.uploadAttempts.set(userId, recentAttempts);
        
        if (recentAttempts.length > this.maxAttempts) {
            analysis.threats.push({
                type: 'high_frequency',
                count: recentAttempts.length,
                severity: 'medium'
            });
        }
    }
    
    calculateRiskLevel(analysis) {
        let score = 0;
        
        for (const threat of analysis.threats) {
            switch (threat.severity) {
                case 'high': score += 3; break;
                case 'medium': score += 2; break;
                case 'low': score += 1; break;
            }
        }
        
        if (score >= 5) {
            analysis.riskLevel = 'high';
        } else if (score >= 3) {
            analysis.riskLevel = 'medium';
        }
    }
    
    logAnalysis(analysis) {
        const logEntry = {
            timestamp: analysis.timestamp.toISOString(),
            user: analysis.user,
            filename: analysis.filename,
            threats: analysis.threats,
            riskLevel: analysis.riskLevel
        };
        
        // Log to file or external service
        console.log('Image upload analysis:', JSON.stringify(logEntry));
        
        // Send to SIEM if high risk
        if (analysis.riskLevel === 'high') {
            this.sendToSIEM(logEntry);
        }
    }
    
    handleHighRiskUpload(analysis) {
        console.error('HIGH RISK UPLOAD DETECTED:', analysis);
        
        // Quarantine the upload
        // Block the user temporarily
        // Alert security team
        // Increase monitoring for this user
        
        this.alertSecurityTeam(analysis);
    }
    
    sendToSIEM(logEntry) {
        // Send to Security Information and Event Management system
        console.log('SIEM Alert:', logEntry);
    }
    
    alertSecurityTeam(analysis) {
        console.log('SECURITY ALERT: Malicious image upload attempt');
        console.log('User:', analysis.user);
        console.log('Threats:', analysis.threats);
    }
    
    generateCSPHeaders() {
        return {
            'Content-Security-Policy': [
                "default-src 'self'",
                "img-src 'self' data:",
                "script-src 'self'",
                "style-src 'self' 'unsafe-inline'",
                "object-src 'none'",
                "base-uri 'self'",
                "frame-ancestors 'none'"
            ].join('; '),
            'X-Content-Type-Options': 'nosniff',
            'X-Frame-Options': 'DENY',
            'X-XSS-Protection': '1; mode=block'
        };
    }
}