Is it safe to store uploaded images as blob data in database?

Question

I am writing a Java web application and I am trying to prevent file upload vulnerabilities by storing uploaded profile pictures as blob in the database. Is it safe to store uploaded images a blob in a database in order to prevent:

1. Executing the files with possible LFI vulnerabilities?
2. Accessing other users files with path traversal?

Can a file be executed when trying to serve the image when retrieving the file from the database? Can I introduce new vulnerabilities by blobbing?

I am planning to represent the image on the following way:

<img src="/path/to/servlet?userID=1"/>

I use MySQL as a database management system, and Glassfish as a webserver on a Windows Server 2012 R2.

Answer 1

I can envisage a couple of possible vulnerabilities that you should keep in mind:

• Uploaded Data overrun - if there is not a way to limit the size of uploads your server could be damaged by sending it a very large file.
• Out of bounds access, since you are allowing the image to be served from the database you are allowing read access to the database, if an index is used to access the image it may be possible to access other locations in the DB, likewise if the read allows incremental reading you could receive read requests that take data from outside of the blob.

You should check the server & BD have tests in place to prevent such attacks/misbehaviour.

Answer 2

Can a file be executed when trying to serve the image when retrieving the file from the database?

The safest way is not to open the uploaded images in the file system of the server, one way to do -as a bad practice- is to create temporary file to serve the image from.

Instead keep images processing between the Servlet and the client by serving the image binary data right from the database.

byte[] content = resultSet.getBytes("content");
response.getOutputStream().write(content);

That is, as long as you keep the image file off the file system any potential threat that come within will not be triggered.