1

I am testing an image uploader but I'm a mere developer. Here are the main points to consider:

  • There are no extension checks.
  • The image is uploaded to memory.
  • It is modified to be a certain size (50px x 50px).
  • It is saved to the database.
  • From testing, it seems if the image size failed, then on re-render the image displayed is simply broken
  • The app is asp.net and is on a Windows server.

With the exception of dodgy file name changing in Linux, is there a weakness? Can anything be executed if it's saved to the DB? I will suggest whitelisting extensions and content type, but is it necessary? If possible please provide a very basic (safe!) example of any major issues.

  • For PNG images, resizing doesn't always remove iTXt chunks, so if there are ways of embedding usable code in those, it will theoretically remain usable after resize. I know of ways to abuse this with PHP, but I'm not an ASP.NET expert, so don't know if there is a comparable way. – Matthew Mar 9 '16 at 8:53
  • do you sanitise? I cant tell if there would be an issue without seeing some code my friend! (I am a developer also! dont say mere :< ) – TheHidden Mar 9 '16 at 9:44
  • always say mere! shift the blame! ha. I cant show code it's not my own. Sanitize what exactly? – user2330270 Mar 9 '16 at 10:19
2

You can create an entirely new copy of the image, store that, and then discard the original.

Your path would become:

  • Upload image.
  • Crop to 50px x 50px.
  • Use ImageMagick or something similar to create an empty 50x50 image (in whatever standard format you want or with other controls added).
  • Copy the pixel data from the original to the new.
  • Save the new version.

If ImageMagick can't read the original, then perhaps there's something funny going on and it should be rejected anyway.

  • This is a good answer because this approach strips all potential metadata from the uploaded image, which is where most image-file-based attacks originate. You could also combine the last four operations using ImageMagick's convert operator with the -strip and -resize 50x50 arguments, outputting to a new file. – John Deters Mar 21 '16 at 22:00
  • Is it better than converting to bit map and removing the meta data in your opinion(s)? – user2330270 Mar 22 '16 at 14:20
  • The site only cares about the pixels. The site should accept as little as possible from the users. You can do all sorts of things with their (untrusted) image, or you can narrowly grab just the part you want and drop everything else. It's the same argument as black lists versus white lists. You can try to think of every possible place they could hide treachery in every possible image format, or you can just approve the 2500 pixels you actually want. – Omniwombat Mar 22 '16 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.