E.g I have Apache installed on a linux server. Web site hosted by Apache supports file upload functionality. Should I use some kind of plugin for Apache to check those files or the OS should take care of it (sandbox like cuckoo )

  • 1
    What kind of threat are you trying to protect against? – user253751 Jul 23 at 12:08
  • Who can upload files, and what happens with those files after they are uploaded? – Philipp Jul 23 at 12:48

You could check using apache2 plugins or by programming to whitelist extensions along with some tools.

In PHP, checking filename, filesize, etc is easy. You should check for both filename and extension. For filename it mustnt be more than 64 character long and only whitelisted extensions should be allowed. Dont rely solely on extension and magic bytes, try to identify by checking magic byte along with its actual content.

If its a image file, there is a tool called identify from imagemagick in linux that identifies whether the image is valid or not. It works by checking magic bytes and image file content. Also, you should strip all exif metadata and prevent uploading of large files.

Further reading: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload

| improve this answer | |
  • Blacklists and extension checks are generally useless. Unlike how windows operates, extensions don't actually determine the type of a file. Instead you whitelist file types which you have validated by checking the actual file contents. – Conor Mancone Jul 23 at 11:59
  • @ConorMancone In some situations, that may be useful. But in others, it can be fatal. Take apache and php: Files will be interpreted based on file extension, not file content. It is trivial to create a valid png file which contains php code and upload it as test.php. Without an extension check, and if uploaded to a public directory, the file will be interpreted and executed as php file when accessed via URL (with default apache configuration). The same is true for other malicious extensions (eg html for XSS). – tim Jul 23 at 12:39
  • Apart from that, an extension check is trivial to get right. A content check on the other hand is notoriously difficult, because valid files of one type may contain content of another type or even be valid files of another type as well, which depending on context can create all sorts of vulnerabilities. – tim Jul 23 at 12:41
  • 1
    @tim to expand further, you should more or less just completely ignore any file information provided by the end user, including the extension. If you are expecting, for instance, a png file, then you should check the file contents to verify that it is in fact a PNG file. You should then be saving it to your upload directory as a .png file, even if the original extension was .php. Ideally you should have your server configured to never try to execute any files in your upload directory (or even better, store uploaded files to S3 or some other place so they are entirely sandboxed). – Conor Mancone Jul 23 at 12:48
  • Checking the file contents is not really that hard, even with the possibility of polygot files. Again, the idea is that you verify that the file is what it is supposed to be and then make sure it can only be used in that one context (or just sandbox the uploaded files all together). As a counter example if you only perform an extension check then, sure, the user can't upload a .php file, but they may upload a javascript file as a .png and make use of an additional vulnerability to execute javascript from your own server - this often helps to circumvent a number of security safe guards. – Conor Mancone Jul 23 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.