Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Exploiting File Upload Vulnerability for images embedded as src="data:image/jpeg;base64"

Andre | Last updated: Nov 29, 2022 10:54AM UTC

Hi there, every now and then I stumble over web apps that are based on JavaScript / JSON frameworks. There is a functionality to upload images, which I can bypass to upload a shell or other file types. However, when displaying the image via the web app, the image is embedded usually in the following way: ``` <img src="data:image/jpeg;base64,/9j/4AAQ...."> ``` Do you see any way to exploit this anyway? So far, I have been capturing the HTTP requests to check from which directory the file has been pulled from and try to access the file directly from there.

Hannah, PortSwigger Agent | Last updated: Nov 30, 2022 09:58AM UTC