3

I maintain a website were users are allowed to upload files. I'm doing already some good MIME-checks, consistency checks, virus checks, blacklist checks based on hash lists, some other custom checks and also I used most of the best-practices around the file upload functionality. But I was thinking about the following worst-case scenario:

Let's say a user will succeed in uploading a SWF file and will be able to access it from my domain and execute it in a browser. Could I isolate or reduce the risks by adding a strict crossdomain.xml file already? Just to prevent escalation in this scenario.

My site is currently not using any flash or silverlight and for that reason I suppose I don't need a crossdomain.xml file. Nevertheless, I'm wondering if I do good to setup a strict configured crossdomain.xml file in case a user will be able to upload and execute malicious code (for example using flash).

I would love to hear some opinions about this! Thanks in advance!

Improve this question
0

2 Answers 2

Reset to default
1

I think that you are asking if you need to protect yourself in case the impossible (or at least highly unlikely) occurs.

I believe that a crossdomain.xml is only involved when a client is directed to load content from the non-originating server. So adding a strict crossdomain.xml file will protect you against that.

But the crossdomain.xml won't protect you from a user directly accessing the SWF file from your server as there's no second-domain involved in that scenario.

If you haven't disabled downloading of SWF files in your web server, I would do that first. Details will depend on the web server your using but it shouldn't be hard to do.

Once you've already disabled both uploading and downloading of SWF files, I guess the crossdomain.xml will help protect against certain attacks but far from all. So I see no harm but I don't see a great gain either.

Hope this helps.

Improve this answer
1

Having no crossdomain.xml means that a Flash application can't make a request to your website in the first place - so if you do not have one that is more locked down already than including one. Unless of course you're allowing users to upload their own crossdomain.xml files?

Additionally crossdomain.xml won't prevent a SWF file that loads from your domain in the first place. If only affects cross domain requests from other domains to yours.

You should concentrate on making sure it is not possible to upload a file can then later be downloaded with the Flash Content Type.

Improve this answer
2
  • Of what significance is the ability to download a file with Content Type Flash, to an attacker?
    – racec0ndition
    Jun 2, 2015 at 17:24
  • It would allow an attacker to host Flash content on your site.
    – SilverlightFox
    Jun 2, 2015 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .