0

If I'm designing a web application that allows people to upload files to scan them for vulnerabilities do I need to worry about the server that accepts the files being infected/corrupted if a malicious file is uploaded? Or will it be fine as long as the file is only scanned and not opened? If there is any danger in accepting these files what measures should I take to protect myself?

  • 2
    Scanning a file for a vulnerability? In general always worry when you let users upload files to your server. – Izmaki Apr 25 at 23:56
  • 1
    @Izmaki Especially if you proceed to apply complex parsers on them. – forest Apr 26 at 5:18
  • 1
    You haven’t specified how you intend to collect these files, nor the level of security awareness your developer, if any has, or if you are planning on using off-the-shelf tools. Any answer given without knowing the actual situation is going to be based on guessing. – Don Simon Apr 26 at 19:54
2

You have very good odds if the file is only scanned and not opened, but there have been instances of malware activating flaws in scanners.

Setup your scanner system to run non-persistently. A golden VM copy can be spun up pretty quickly for each scan instance. That way even if compromised it's only momentary.

Granted it's not impossible to also compromise the host under the VM, but compromising the scanner, the VM, and the Host is a pretty high bar.

Good Luck!

1

Any application that accepts unrestricted file upload is subject to being exploited, if not properly secured.

OWASP has a really nice article on this subject, with a whole section regarding security practices you can use to protect your app.

https://www.owasp.org/index.php/Unrestricted_File_Upload

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.