1

Ok, so I have my own website, and you can use the file upload quite a bit, and it is very important to the site. However, I've been hearing that clients can still bypass a file extension restrictions (I only allow PNG and JPG), and then they can inject malware into the site.

So, I was thinking of a way to prevent this, however I'm not sure if it would fully work. So, I was thinking that after a file is uploaded, I by default set the extension to a PNG.

Would this stop any code from being executed if there was an upload of a file with malware that bypassed the extension filter?

4

Uploading a virus won't infect something. Interpreting the virus in the interpreter the virus was meant to exploit will (i.e. Acrobat opening a PDF; the OS launching an x86_64 binary; etc). This is something to think about when you evaluate your threat model.

The importance of extensions

File extensions are only hints to handling instructions. Only Windows has such a strong relationship between the file's extension and the identity of the file.

There are two different issues here:

  • The file is a virus. They can be named virus.exe or virus.png - it doesn't matter. What matters is:

  • The file is interpreted by the interpreter the virus is meant to exploit. This means somebody opens a tainted PDF file with Acrobat or a tainted executable file by running it - after possibly renaming it.

Sidenote: "interpreted using the interpreter the virus is meant to exploit" is not a typo. It is a pedantic explanation. For example: the processor is not an application, but it is an interpreter and it can be exploited.

If somebody uploads virus.exe and you replace the extension with virus.png, somebody's computer may go "Hey, that's not a PNG, but it does look like an executable" and executes it anyway, that didn't help.

If somebody uploads virus.png, the same thing can happen.

Obviously it is obviously more likely for somebody's computer to interpret a virus.exe as an executable than it is for it to interpret virus.png as an executable, so there is some validity to this. However, simply renaming things doesn't change very much - it only pisses people off later when they get a 'corrupted' png file.

What should you do?

My suggestion: Have your server run some [trusted] program on every image uploaded and tell that to convert it to a PNG or a JPG. If it fails to do so, then the uploads weren't images. If it succeeds, you also managed to remove any viruses which may have been hidden in the same file.

Another suggestion, which is easier to do immediately but is really more of a first-pass risk mitigation technique: reject uploads which don't end in PNG or JPG - don't just rename them.

| improve this answer | |
  • 1
    What if the upload is meant to exploit a bug in the image converter pipeline? – Neil Smithline May 8 '16 at 4:45
  • Then that sucks. The OP allows people to upload files; at this point we're in risk-mitigation. Having a converter pipeline reduces the chance of a breach, almost eliminates a chance of a breach for the end-viewer of the image, but opens the server itself up to a possible issue. Not using a converter protects the server but not the end-viewer. – iAdjunct May 8 '16 at 4:49
  • You can always check the upload against image specific functions opposed to converting the image. For example using the getimagesize() function on an upload in PHP will fail if it is not an image. – Bacon Brad May 8 '16 at 7:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.