3

Currently working on a website which allows users to upload data files for automated processing. For both security and user guidance purposes, we implemented an extension whitelist both client and server side to only accept common data suffixes like .txt and .csv and so on.

We have now discovered that some data files which we get sent don't have any file extension at all.

These files are not executed by the processes after upload: they are parsed for text patterns. So having unverified files up on the server does not - theoretically - present a big security risk. The data being processed, however, is personal data covered by data protection law, so a breach would be catastrophic.

Is it safe to allow users to upload files without extensions is this instance? And, as a wider question, is it ever good practice to allow a site to permit these files?

|improve this question
  • 1
    "So having unverified files up on the server does not - theoretically - present a big security risk" - this might be true in itself, however if someone where to find a Local File Inclusion vulnerability on your service then you have a potential kill chain. If a file can be renamed after upload (through legitimate, or illegitimate means) then you can potentially have malicious files loaded (assuming correct exploit conditions in place). – DKNUCKLES Jan 5 '18 at 15:12
1

The extension itself should not matter. It would be good to figure out the MIME type to know about the content instead.

In terms of security risks in terms of file uploads, please see also https://www.owasp.org/index.php/Unrestricted_File_Upload

|improve this answer
1

You should be doing server side checks to ensure that the content you are getting is what you expect. You probably want to review the content of the files to ensure it is restricted to the specific business requirements. e.g., if this is to upload a CSV of birthdays, there shouldn't be <script> tags in the file.

You generally don't want people storing random stuff on your servers unless you are DropBox or a service like that. In which case you should be taking special precautions like storing the files on a server on their own sub-domain and limiting remote execution and downloading, A/V scanning, etc.

These files are not executed by the processes after upload: they are parsed for text patterns. So having unverified files up on the server does not - theoretically - present a big security risk. The data being processed, however, is personal data covered by data protection law, so a breach would be catastrophic.

If you allow arbitrary files to be uploaded to your server there are a few risks:

  • If it is a script and your server is misconfigured, it may allow the uploaded file to be executed server side. e.g., Your using apache and they upload a PHP file, but you have something like DefaultType application/x-httpd-php or ForceType application/x-httpd-php in your config.
  • Local File inclusion attacks are possible if you can get another script or service to call this file.
  • If its a JS file then they can upload a file to your server and call it remotely in their XSS attacks.
  • If its a endpoint script (bash, PowerShell) then it could be pointed to from another script to be downloaded by wget, curl, etc and then executed
|improve this answer
0

Adding extension will not fix potential file parser vulnerabilities issue, user can rename a malformed file with csv/txt with little trouble.

You should write down all the potential risk and close them up e.g.

  • Check the file type, there should be modules to deal with this
  • Use a tools to search for potential injection keywords in the CSV before perform parsing
  • Go through the SQL injection Prevention Cheat sheet.
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.