Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Web application allows users to upload files. Is it necessary to scan those files by antivirus?

I'd want to hear answer in two scenarios:

  1. Type of file isn't checked when uploading. They are stored in folder that isn't directly accessible from the internet. Files don't have permissions to execute. Then user may query some url, and files will be returned with Content-Disposition: attachment
  2. Type of file isn't checked when uploading. It's contents is parsed with some HTML/XML/JSON/etc. parser. After parsing file isn't stored at server
share|improve this question
    
In case 1, beware of pranksters submitting EICAR and then having the download get rated by their anti-virus program. All alarm bells probably go off and your domain is blocked for everybody using that AV, or at least that happened to me once... Only I uploaded it myself so I wouldn't have to look EICAR up all the time. I figured I'd better move it to a private directory :P –  Luc Nov 1 '12 at 20:04
    
Nobody mentioned an important detail: threat model. In your threat model, are the people uploading these files considered to be potential attackers? If so, then #1 is a must. –  mehaase Nov 2 '12 at 1:41
add comment

4 Answers

In scenario 1, you can safely assume that the content will not be executed on the server, and the user will be forced to download the file rather than viewing it in their browser. This is reasonably safe from your point of view, because you offload the responsibility of checking the file to your users.

In scenario 2, I'd definitely run it through an AV. Your parser library might have a vulnerability, so you most definitely want to do some basic checks before handing it off to the library.

share|improve this answer
1  
It doesn't seem more likely that my parser library contains a vulnerability than that the anti-virus contains a vulnerability. –  CodesInChaos Nov 1 '12 at 9:54
    
Some well known parser libraries like nokogiri have very low number of vulnerabilities ever found so I'm not sure defense in depth is necessary –  Andrey Botalov Nov 1 '12 at 9:57
1  
Sure, but by that logic nobody should ever check anything. –  Polynomial Nov 1 '12 at 9:57
1  
Would typical COTS antivirus software be able to detect parser exploits? –  Stephen Touset Nov 1 '12 at 19:12
    
A firewall might catch the payload as it moves across your network, but the AV isn't likely to unless it hits disk. –  Polynomial Nov 2 '12 at 6:55
add comment

I see no reason to use a virus scanner in the second case. The chances of a code-execution vulnerability in an anti-virus seem larger than that of a vulnerability in my parsing libraries. Especially if the parsing libraries are written in a memory safe language.

In the first case I'd use an anti-virus, since offering virus files for download doesn't sound like a good idea. Both people and automated website reputations systems(for example google safe browsing) might associate virus downloads with your website hurting its reputation.
I might still offer such a file for download, but only after an explicit warning and user confirmation. Preferably a confirmation that prevents bots from downloading it.

share|improve this answer
    
I agree that anti-virus is over kill but perhaps running some kind of normalization on the data before passing it to the parser might reduce risk. –  Andy Smith Nov 1 '12 at 18:16
    
What parsers are written in memory-safe languages? Most HTML, XML, and JSON is parsed in C or C++ code. –  mehaase Nov 2 '12 at 1:40
    
@mehaase For example JSON.net and Html Agility Pack are written in C#. –  CodesInChaos Nov 2 '12 at 10:58
add comment

If someone asked you to carry a sealed package as part of your luggage on a commercial flight, would you?

Even if you're just providing a respository for users to store their own files rather than re-publishing the uploaded content, it would be reckless to accept anything that is thrown at your server.

However AV scanning is not the only way to protect against malware - verifying the mimetype and using a lossless conversion method to switch between formats can neutralise a large proportion of threats (e.g. convert jpg to png, MSWord doc to pdf*). If you have implemented your own parser for the file and it's a basic format such as XML, then you're already verifying the contents - AV scanning is probably overkill. But like all code, it should be secure.

*) but not using MSWord to do the conversion!

share|improve this answer
    
Good suggestion to convert files first, but I think that doesn't work in this case. There is no way you could do this for all possible filetypes. –  Luc Nov 1 '12 at 22:43
add comment

Type of file isn't checked when uploading. They are stored in folder that isn't directly accessible from the internet. Files don't have permissions to execute. Then user may query some url, and files will be returned with Content-Disposition: attachment

Scanning before delivering the attachment is just the courteous thing to do, but there are lots of things that are problematic to store but which will pass a virus scan just fine.

This may be a tad paranoid, but if you wouldn't intentionally write software that lets people plant evidence that incriminates you, don't unintentionally write software that does that.

What kind of information do you log about the uploaders? Might you have enemies who would upload child pornography or bomb-making plans to your server and then send an anonymous tip to the police?

Type of file isn't checked when uploading. Its content is parsed with some HTML/XML/JSON/etc. parser. After parsing the file isn't stored at server.

Anti-virus scanners are unlikely to be helpful here. Same question as above. Can you sanity check the information you extract from the files or prove that whatever information you store came from an external source?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.