I am working on a file upload feature in our app. Users can also download uploaded files from the app. To prevent malicious file upload, I am checking magic bytes of the file to find the file type uploaded and verify its part of my whitelist (doc", "pdf",xls", "xlsx", "docx", "png", "jpeg", "ppt", "pptx", "msg", "jpg", "gif").
I am good so far and now it occurred to me a scenario where in user can upload a file say like
- ms word which can have an embedded exe or any malicious file.
- outlook message item which can have an malicious file attachment.
Are these scenarios valid case of attacks on Unrestricted file upload? If so how to handle these? Appreciate any insights on this.