The pitfalls of allowing file uploads on your website
blog.detectify.com
The pitfalls of allowing file uploads on your website
1–10 of 32 posts
Re: The pitfalls of allowing file uploads on your website
#2Should clarify: "The pitfalls of hosting user-uploaded files on your website"
Hosting user-uploaded files on a separate domain would probably solve this problem.
Re: The pitfalls of allowing file uploads on your website
#3Should clarify: "The pitfalls of hosting user-uploaded files on your website" Hosting user-uploaded files on a separate domain would probably solve this problem.
How does simply using a different domain protect against malware?
Re: The pitfalls of allowing file uploads on your website
#4Should clarify: "The pitfalls of hosting user-uploaded files on your website" Hosting user-uploaded files on a separate domain would probably solve this problem.
How does simply using a different domain protect against malware?
As the article explains, the problem is that SWF files hosted on one domain can execute in the security context of that domain, even when embedded in a page on a completely different site. So allowing attacker-controlled uploads makes any credentials on that domain, such as session cookies and CSRF tokens, vulnerable. If the SWF is hosted on a domain with no sensitive credentials, this particular problem goes away.
Re: The pitfalls of allowing file uploads on your website
#5The bottom line is this, if users can upload something to your site, and then your site will show that thing to other users before you have a chance to figure out if its a problem, then your site will be exploited by bad actors.
For a long time an out of the box server installation would include anonymous ftp access. Of course nothing is quite so attractive as a 'free' place to dump and retrieve stuff. It was kind of like setting up a warez/malware camera trap.
Re: The pitfalls of allowing file uploads on your website
#6Earlier quoted context omitted.
How does simply using a different domain protect against malware?
As the article explains, the problem is that SWF files hosted on one domain can execute in the security context of that domain, even when embedded in a page on a completely different site. So allowing attacker-controlled uploads makes any credentials on that domain, such as session cookies and CSRF tokens, vulnerable. If the SWF is hosted on a domain with no sensitive credentials, this particular problem goes away.
Reminds me of this Google Docs phishing scam, that uses a Google domain to look legit http://www.symantec.com/connect/blogs/google-docs-users-targ...
Re: The pitfalls of allowing file uploads on your website
#7Hold-on, doesn't using a
Content-Disposition: attachment; filename=”image.jpg”
Most services seem to be moving file uploads to S3 (or similar services) these days, so I'm not sure this advice is really helpful. To take that a step further, my preference now is to upload directly to S3 and bypass my app server altogether. At least in Rails, it's fairly easy to setup.
Re: The pitfalls of allowing file uploads on your website
#8Earlier quoted context omitted.
As the article explains, the problem is that SWF files hosted on one domain can execute in the security context of that domain, even when embedded in a page on a completely different site. So allowing attacker-controlled uploads makes any credentials on that domain, such as session cookies and CSRF tokens, vulnerable. If the SWF is hosted on a domain with no sensitive credentials, this particular problem goes away.
Reminds me of this Google Docs phishing scam, that uses a Google domain to look legit http://www.symantec.com/connect/blogs/google-docs-users-targ...
Google Drive does let you host arbitrary content, but from googledrive.com, not from google.com.
https://support.google.com/drive/answer/2881970
This is basically the same as github.io.
The Symantec article is interesting but only says the fake page is hosted on "Google's servers", not "google.com", but users might believe "googledrive.com" is trustworthy.
Re: The pitfalls of allowing file uploads on your website
#9The bottom line is this, if users can upload something to your site, and then your site will show that thing to other users before you have a chance to figure out if its a problem, then your site will be exploited by bad actors. For a long time an out of the box server installation would include anonymous ftp access. Of course nothing is quite so attractive as a 'free' place to dump and retrieve stuff. It was kind of…
Even if it does not show anything to other users, just having the wrong extension can already bite you badly.
Uploading php files instead of images has been used to gain access to machines. Anything that gets stored as a file on the filesystem of the destination machine is a huge risk. All it takes is one little misconfiguration somewhere else and you're wide open.
Re: The pitfalls of allowing file uploads on your website
#10The bottom line is this, if users can upload something to your site, and then your site will show that thing to other users before you have a chance to figure out if its a problem, then your site will be exploited by bad actors. For a long time an out of the box server installation would include anonymous ftp access. Of course nothing is quite so attractive as a 'free' place to dump and retrieve stuff. It was kind of…
and then your site will show that thing to other users
I think this is worth emphasizing more than the article does. The problem is just as much with the after-the-fact direct access as with the upload. Given the wide variety of illegal things you will quickly end up hosting and the amount of traffic this will generate, cross site scripting attacks may not be your top concern.