When creating or testing a file upload functionality how do you deal with Office documents assuming that the client wants to be able to upload .doc/.docx/.xls/.xlsx?

I have found quite some reading material about the possibilities of writing your malware in Office documents in macro's and other functionalities. But I have also found that no one really has a good way to filter out all harmfull possibilities with Office documents.

Users upload these files and other users download these files and open them as they see fit (as in we have absolutely no control over the users). How do I protect the users from other users that try to upload malware?

  • 2
    Who are you trying to protect? You or your users? And what do you do with these documents? Just host them? Open them in an editor on your servers? Process them in some way? – Hector Nov 14 '17 at 11:31
  • Worth noting if it were 100% reliably possible to filter out malware in word documents editor and library writers would have done so and malware wouldn't be an issue any more. You should always assume bugs in anything as complex as a modern document editor. – Hector Nov 14 '17 at 11:33
  • Yes sorry that was not clear in the question. I am protecting the users, we host the files and users can download them from other users. But it might be that those users don't really have the best intentions for the other users (can't go in detail what we do off course, but lets assume it is possible they want to hurt eachother) – Wealot Nov 14 '17 at 11:33
  • Then short of using off the shelf virus scanning tools and keeping lookup tables of hashes of known malicious documents there isn't much you can do. One option is to only allow x rather than m formats (xlsx instead of xlsx+xlsm) files which cannot contain macros - but even these can exploit bugs in office and it adds restrictions to your legitimate users. – Hector Nov 14 '17 at 11:36
  • I was afraid of that. Just a quick follow up on this: are macro's really only possible in xlsm? When I create a .docx tekst document with a macro the macro still runs.... – Wealot Nov 14 '17 at 11:40

Well you have 2 possible defense lines here and my advice would be to combine both.

  1. try to filter malware out of the documents

    • you could try to use an antivirus to automatically scan any uploaded file and reject it when positive
    • you could try to filter any macro out of office documents, but it could be harder than it seems at first sight, because there are numerous formats, and it will be easy to let one unfiltered
  2. use a reasonably strong authentication system - one that you can trust to be able to unambiguously identify the real user in your use case - and consistently log all actions including versioning of files if they are modified

    • if a malware is later found on your system, you will be able to identify the culprit - with all legal consequences involved
    • it can be seen as a dissuassive weapon: if users know that they could be later charged for their bad actions, they are likely to try another way

Once upon a time, I wrote some code to try and handle MSOffice document uploads. This was back in the day when there was only binary OLE containers to worry about. With MSWord and MSExcel, it was quite easy to strip out the macros. However the versions of PowerPoint formats around were a different story (so much so, I'm still surprised that a Powerpoint macro virus didn't lead to the data apocalypse). Now, with multiple container formats it seems a much more imposing task.


no one really has a good way to filter out all harmfull possibilities

then there is no way

to protect against malware uploads when you also want to be able to upload office documents

The best you can do is:

  • convert them to a different format on the fly using something which is less likely to be susceptible to the malware (e.g. libreoffice running in a sandbox)

  • Virus scan files on receipt and on download (good luck finding documentation on the APIs - most AV products are really poor for application integration)

  • Try to isolate yourself from any liability arising from the damage caused if malware is propagated via your service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.