3

I know that there are many posts about these topic. But those posts usually talk about restricting the file types and sizes on so on. Hence non serves to my needs as my system does not have any constraints.

Let's say we have a web application, which accepts uploads from users logged in. These users are authenticated via Active Directory. Anonymous users are not allowed.

Users can upload any type of file to the system. Then users can preview the files uploaded via our multi purpose viewer. Right now we support some basic file types, like pictures, music, video, pdf files and office files. I decide for viewable types by checking a dictionary for viewable types, and if the type don't exist it won't be previewed but downloaded directly.

I am curious about the security risks I have, hence I will try to elaborate my system.

I have two different systems in terms of file keeping procedure:

  1. An internet application where the storage is a structured file system where file names are changed with guids
  2. An intranet application where the storage is an unstructured file system where files are directly on the network drive as the user uploaded them, and users can access the files via network drive too

For both applications the previewing strategy is the same.

All files are served from an action method which can only be accessed while authenticated. And logical path traversal for the uploaded files are allowed.

The non-office files are returned to the client, and shown in img, video and embed html tags.

On the other hand, the office files are first executed via interop libraries of the Microsoft Office, converted to pdf, then returned to the client, and again showed as a regular pdf.

I am wondering, through these processes am I compromising any security here on the server side? I know that user can upload malicious files, but is there any way user can harm my system upon writing or reading process of the files?

  • To allow upload any kind of file always is a risk. The first step is done (uploading a malicious file)... then, it depends of other factors to be able to execute that file (a malicious shell php file if your web is using php for example). Hard to know, it depends of your web application if you are command injectable or not. – OscarAkaElvis Jan 23 '17 at 8:29
  • I use, as I thought I've pointed out at my tags, asp.net-mvc framework. Hence my system is not command injectable. If that's the main weak point than I'm good? – Tolga Evcimen Jan 23 '17 at 12:46
  • Sorry, didn't saw the tags. I'll try to give an answer – OscarAkaElvis Jan 23 '17 at 13:12
1

On a server perspective, you're allowing others to put things directly into the file system without (much) validation. Database storage is comparatively safer, as binary data is not directly executable. However direct file storage using the OS's file system has better performance.

If files are stored on a file storage, a targeted hack might be to upload a specially crafted file onto the server, then somehow trigger the server to process it (be it an xml, zip, exe etc.).

At the very least, you should alter the permissions of the folder containing user uploaded files such that they are not executable. I'd go one step further and programmatically replace all file extensions to something like .exe_, .pdf_. After all, you don't actually have to store the files in the way they're uploaded, you just need to present the data in application logic. Altering the file extension would hopefully break any file type associations or auto-trigger mechanisms.

  • As my second system scenario requires, I cannot rename the files. I actually need to know, what kind of "auto-trigger mechanisms" exist? Don't I need to avoid them first? – Tolga Evcimen Jan 23 '17 at 14:30
  • @TolgaEvcimen you can rename the files. I assume you're using the built-in Windows mechanism for a network drive. You can also choose to introduce an application layer. It only needs to speak the network protocol so other clients think it is a network drive. – kevin Jan 23 '17 at 14:32
  • @TolgaEvcimen e.g. in the recent years there was a bug in Window's XML parsing component which (in theory) allows arbitrary code execution. Xml files are common configuration files. There can be an application which, say, scan a directory, check if config.xml exists, if yes, process it. Or there might be an image converter which converts all jpg to png. Most of these programs check the file extension to determine the file type. – kevin Jan 23 '17 at 14:39
  • :) I know I can rename the files, it's just the requirement. – Tolga Evcimen Jan 23 '17 at 17:00
  • you could rename the files into a hash and associate the hash and the original name on a database, when you serve or list the files, go fetch the original name before serving the file. In that way the renaming will not even notice the file was renamed. – Joaquin Brandan Apr 3 '18 at 21:57
1

Usually regular path on web hacking could be in a quick summarized way something like:

  • Find a vulnerability (scanning, fingerprinting, etc)
  • exploit the vulnerability
  • Write some kind of evil payload/shell or whatever
  • Access/execute that evil stuff
  • More and more non-important for this question steps after this.

On your system, the third point is free!. I'm not saying you are going to be hacked. But with a system like this you are putting the things a little bit easier if previous steps are completed, that's all.

Remember that only one weak point and everything is possible. Of course the most dangerous is the direct command injection. If there is no present ok, but maybe after exploiting other vulnerability could be possible to launch some kind of command in the system, for example through SQL injection. Depending of the systems, databases and versions, could be possible to execute system commands from the database.

So, beware of ALL! XSS injection, SQL injection, command injection, CSRF, RFI, etc.

And of course, check the version of ALL your components (web server, kernel, operating system, etc). If you use one component with known vulnerabilities maybe you can be hacked even with a good development in the app side.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.