google / google/magika

[Misdetection] PHP file misdetected as image when image is injected at the start of the file

Open
#468 2 comments 0 reactions 0 assignees View on GitHub
misdetection
Dominant language
Rust
Stars
18.6k
Forks
1.2k
Avg merge
3d 12h
Merged PRs (30d)
20

Description

If you take an image file, append PHP code to it (and rename to .PHP) it will be recognized as image. Old PHP code injection vulnerabilities were possible with such files when the code used a bad source of mime type detection.

Example file (PNG icon with phpinfo at the end):
[example.zip](https://github.com/google/magika/files/15380904/example.zip)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.