File Upload Race Condition in Web Applications

 File upload functionality is a common feature in modern web applications, but when implemented incorrectly, it can introduce subtle yet critical security vulnerabilities. One of the most interesting and less intuitive issues is a race condition in file upload handling.

Understanding the Vulnerability: Race Conditions

A race condition occurs when the outcome of a system depends on the timing of multiple operations occurring concurrently. In web applications, this often manifests as a Time-of-Check to Time-of-Use (TOCTOU) issue.

In file upload flows, the application typically performs steps like:

1. Receive uploaded file
2. Validate file type or contents
3. Store file temporarily
4. Move file to final destination
5. Make file available via web server or processing logic

The vulnerability appears when there is a small time window between these steps where the file exists in an intermediate, inconsistent state.

If an attacker can send carefully timed concurrent requests, they may be able to interact with the file before validation completes or before it is moved to a safe location.

Exploitation Concept

In a typical vulnerable scenario:

• Request A uploads a malicious file (e.g., a PHP script)
• Request B attempts to access or execute the file immediately after upload
• Due to concurrency, Request B may reach the file before it is relocated or blocked

If the file is executed during this window, it can lead to remote code execution (RCE).

A typical payload in a controlled lab environment might be:

<?php system('cat /home/carlos/secret'); ?>

If executed successfully by the server, this would return sensitive data from the system.

For this instance, we need echo the output of the flag inside carlos directory to finish the lab. 

How Attackers Trigger the Race Condition

Attackers typically try to maximize the likelihood of overlapping execution by:

• Sending multiple requests simultaneously
• Minimizing network delay differences
• Repeating attempts to hit the vulnerable window

In controlled security testing tools such as Burp Suite, this is often achieved using request synchronization features, allowing multiple identical requests to be dispatched in near-perfect parallel.

This increases the probability that one request reaches the execution stage while another is still being processed.

LAB Example: 

result:

Impact

If successfully exploited, file upload race conditions can lead to:

• Remote code execution (RCE)
• Unauthorized file access
• Privilege escalation
• Full system compromise (in severe cases)

Because uploads are often exposed to untrusted users, the impact can be critical.

---

Mitigation Strategies

To defend against this class of vulnerability, developers should ensure:

1. Atomic File Handling

Use atomic operations when moving files from temporary to permanent storage.

2. Strict Isolation

Store uploaded files outside the web root until fully validated.

3. Secure Execution Controls

Never execute uploaded files directly from user-controlled directories.

4. File Renaming Strategy

Rename files unpredictably before storage to prevent race targeting.

5. Queue-Based Processing

Process uploads asynchronously through controlled pipelines.