1

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the picture's content (file-contents: ‰PNG...... via post request) then display it on the browser like, as <img src="data:image/png;base64,.....> ?

  • or use a library that is hopefully tested for bugs. – Vipul Nair Feb 24 at 1:18
  • @VipulNair Not interested in implementing anything myself (I don't own a website), rather to know if the process of uploading a PNG and displaying it in the way I described, is vulnerable – Annie Feb 24 at 1:30
  • there are some malformed images that cause problems in some browsers in some contexts from time to time. There's not a universal well-known issue with displaying image data, only targeted bugs that creep up sporadically and generally get patched-out quickly. – dandavis Feb 24 at 18:33
1

Most definitely!

File uploads can be very tricky and there is a lot that can go wrong. There are (at least) two further steps you should take:

1. Verify that the file is actually a PNG

If you are expecting only PNGs, then you should verify that the file is actually a PNG. To be clear, checking the extension is useless here - you want to check the actual file contents themselves. If you don't do this you open yourself up to a few potential attacks of varying levels of severity:

  1. An attacker can upload a JS file. This can help as part of a multi-step attack by bypassing a CSP or other restrictions.
  2. An attacker could host their own HTML files/images/an entire website on your website, potentially making phishing or other attacks much, much easier.
  3. Depending on your server setup, an attacker may be able to upload scripts and have your server execute them, compromising your system.

2. Make sure the file cannot be executed by the server

Even if you check to verify that the file is a valid PNG, this may not be enough to stop an attacker from using your file upload to upload and execute scripts. In particular, most image formats allow for comments and meta data in headers. It is possible to put actual code in these comments, and in the event of permissively configured servers, the attacker may be able to trick the server into executing it. Most modern servers with default configurations will be immune to such attacks, but attacks like this are possible and definitely have happened.

Bonus: Host somewhere else

The most straight-forward way of mitigating the above attacks is by hosting your uploaded files elsewhere. Most modern cloud providers have buckets that are a perfect use case for this (AWS, GCP, Azure), but you can always manage it yourself with a separate server on a different domain that only serves static files. By hosting the uploaded files on a different domain you skip the risk of CSP bypass, and by hosting it on a server that is incapable of treating files as code, you don't have to worry about missed vectors for RCE. In essence, by immediately transferring uploaded files to a separate system, you're putting them in a sandbox for safety.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.