Usablity vs security malicious file upload

Question

We were designing a web application which has the functionality similar to vulnerability management, our web application functionality can be briefed as follows:

• There is a panel where one can launch a program for listing vulnerabilities
• Bob launches his program through our web application
• Alice reports the vulnerability with malicious file
• Bob receives report with malicious file and gets a warning stating that download might have relative consequences
• Bob downloads the malicious file and fall as victim for Alice

Now as per functionality/usability my developer argues that.

• We can allow malicious file upload to the application as its core feature of the application (Alice will upload vulnerable file as proof of concept)

• We were showing warning message, its enough to prevent users from downloading malicious file, since all users would be tech-savy

Now my argument was as follows:

• Attacker can user this platform to social engineer the response team (here Bob would get infected)
• As a responsible vendor, the clients will trust us and download the file
• Also I referred unrestricted file upload

So considering above situation what would be the best bet to prevent my clients from being fallen as victim for attackers.

Answer 1

If you disallow file uploads, researchers will host their proof-of-concepts elsewhere and provide you with a link to the remote resource, leaving you with essentially the same problem.

The common practice varies. The popular platform HackerOne (which provides pretty much the service you described) allows file uploads, but includes an appropriate warning before offering the download. Google's bug bounty program, on the other hand, does not allow uploads on their bug report form.

Either way, your response team should work in a sandboxed environment and open files only if necessary. I disagree that uploads are "a core feature", as many vulnerabilities can be explained without attachments but via plain text and inline code snippets - although your customers might think otherwise.

Hosting the attachments securely is a topic to itself, but most importantly, you should store all user uploads on a server separate from your web application.