Security risks downloading external images automatically from script

Question

I'm a developping a program which generates images from HTML files filled with external RSS feeds data. When the RSS feed contains images, I need to check their resolution and format (for instance, if the image is an animated GIF I have to do a specific operation to animate the final rendering). The feed updates are performed by a job in C#, which also generates the HTML file. The final image is generated by PhantomJS (or more probably another scriptable headless browser, since PhantomJS development was suspended recently).

What are the security risks in downloading the images from the RSS links in C# to check their resolution and format? Would it be more safe to check all that in the JS script I provide to PhamtomJS?

The RSS sources are supposed to be safe but they still are external sources...

Answer 1

From my point of view you need to follow the next steps to make it secure the download of the images.

1. Download the image with read only permissions on the box.
2. Verify the format of the received file (for example with the library libmagic that will tell you if is a real image with big probability).
3. Open the file with your program for read the resolution, and other values.
4. Delete the file.

So in case you download a executable file that somebody on the internet rename to .jpg the step 2 and step 3 will fail.

Probably wait until other users give you other useful options.

Answer 2

Considered question of security impact could be related to Unrestricted File Upload vulnerability (see OWASP Unrestricted File Upload).

As RSS feed is an external system the content from that systems can't be considered as trusted. MIME type of this content must be validated and images need to be sanitized before they will be placed on the server to use.

Please see classic possible attack bellow:

• A malicious code placed after image content. The application allows to include file during execution (for example with functions like php include). As result the code from image will be executed.
• Generate a phar archive based on image content. Users will see image but the file will be contain a malicious code in phar metadata. You can see detailed report about this kind of vulnerability at follow links:
• New PHP Exploitation Technique
• phar:// PHP Unserialization Vulnerability

Except outlined above cases with RCE it is possible case when RSS feed is hacked and images with several Gb sized are in the feed. You can consider possible impact to your system in this case as well.

Images with SVG format could contain XSS as well. It can be exploited when user open image in his browser.

Answer 3

It is time to be pedantic.

You should avoid downloading images, but that is OK because it is impossible to download an image anyway. All that can be transmitted across a network is files (to be even more pedantic, sequences of bytes.

No downloaded file is ever unsafe. It only becomes unsafe once you start to do something with it. For instance, if you pass those bytes to a so-called “image decoder” which has two functions: (a) if the bytes represent a valid image, do something rational such as converting the image to another format; (b) if the bytes do not represent a valid image, do something harmful to the system - then harm can result. The reason we distrust images and call them”unsafe” is that we are mostly using image decoders that contain, by design, some elements of function (b).

In your particular case, therefore:

1. Downloading a file is always safe. In fact, for your purposes you only need to download a small initial portion of it, so you do not even have to worry about “what if the file is 1GB in size?”

2. Treating the downloaded file as an image file is never safe - unless you can guarantee that the program, function or library doing the treating is guaranteed never to perform function (b), “damage the system”.

3. Accordingly, do not use an image decoder on the downloaded file.

4. Instead, do your own interpretation and validation. For instance, read about the image file formats and work out, yourself, how to extract parameters such as size and format. This is very simple and completely safe. The result will be “Yes, this is a not-obviously-invalid PNG of such and such a size”, “Yes, this is a not-obviously-invalid JPEG of such and such a size”, “No, this is none of the above”.

You say that your validation code only needs to extract size and format and resolution information. Doing it yourself without relying on library functions or deciders is absolutely safe.

Moreover, the validation you describe can be performed using only the first few bytes of the downloaded file.