0

I'm a developping a program which generates images from HTML files filled with external RSS feeds data. When the RSS feed contains images, I need to check their resolution and format (for instance, if the image is an animated GIF I have to do a specific operation to animate the final rendering). The feed updates are performed by a job in C#, which also generates the HTML file. The final image is generated by PhantomJS (or more probably another scriptable headless browser, since PhantomJS development was suspended recently).

What are the security risks in downloading the images from the RSS links in C# to check their resolution and format? Would it be more safe to check all that in the JS script I provide to PhamtomJS?

The RSS sources are supposed to be safe but they still are external sources...

bumped to the homepage by Community 4 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

0

From my point of view you need to follow the next steps to make it secure the download of the images.

  1. Download the image with read only permissions on the box.
  2. Verify the format of the received file (for example with the library libmagic that will tell you if is a real image with big probability).
  3. Open the file with your program for read the resolution, and other values.
  4. Delete the file.

So in case you download a executable file that somebody on the internet rename to .jpg the step 2 and step 3 will fail.

Probably wait until other users give you other useful options.

0

Considered question of security impact could be related to Unrestricted File Upload vulnerability (see OWASP Unrestricted File Upload).

As RSS feed is an external system the content from that systems can't be considered as trusted. MIME type of this content must be validated and images need to be sanitized before they will be placed on the server to use.

Please see classic possible attack bellow:

  • A malicious code placed after image content. The application allows to include file during execution (for example with functions like php include). As result the code from image will be executed.
  • Generate a phar archive based on image content. Users will see image but the file will be contain a malicious code in phar metadata. You can see detailed report about this kind of vulnerability at follow links:
  • New PHP Exploitation Technique
  • phar:// PHP Unserialization Vulnerability

Except outlined above cases with RCE it is possible case when RSS feed is hacked and images with several Gb sized are in the feed. You can consider possible impact to your system in this case as well.

Images with SVG format could contain XSS as well. It can be exploited when user open image in his browser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.