How to deal with Office documents in file upload?

Question

When creating or testing a file upload functionality how do you deal with Office documents assuming that the client wants to be able to upload .doc/.docx/.xls/.xlsx?

I have found quite some reading material about the possibilities of writing your malware in Office documents in macro's and other functionalities. But I have also found that no one really has a good way to filter out all harmfull possibilities with Office documents.

Users upload these files and other users download these files and open them as they see fit (as in we have absolutely no control over the users). How do I protect the users from other users that try to upload malware?

Answer 1

Well you have 2 possible defense lines here and my advice would be to combine both.

1. try to filter malware out of the documents

   • you could try to use an antivirus to automatically scan any uploaded file and reject it when positive
   • you could try to filter any macro out of office documents, but it could be harder than it seems at first sight, because there are numerous formats, and it will be easy to let one unfiltered

2. use a reasonably strong authentication system - one that you can trust to be able to unambiguously identify the real user in your use case - and consistently log all actions including versioning of files if they are modified

   • if a malware is later found on your system, you will be able to identify the culprit - with all legal consequences involved
   • it can be seen as a dissuassive weapon: if users know that they could be later charged for their bad actions, they are likely to try another way

Answer 2

Once upon a time, I wrote some code to try and handle MSOffice document uploads. This was back in the day when there was only binary OLE containers to worry about. With MSWord and MSExcel, it was quite easy to strip out the macros. However the versions of PowerPoint formats around were a different story (so much so, I'm still surprised that a Powerpoint macro virus didn't lead to the data apocalypse). Now, with multiple container formats it seems a much more imposing task.

If

no one really has a good way to filter out all harmfull possibilities

then there is no way

to protect against malware uploads when you also want to be able to upload office documents

The best you can do is:

• convert them to a different format on the fly using something which is less likely to be susceptible to the malware (e.g. libreoffice running in a sandbox)

• Virus scan files on receipt and on download (good luck finding documentation on the APIs - most AV products are really poor for application integration)

• Try to isolate yourself from any liability arising from the damage caused if malware is propagated via your service.