0

In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to limit the files by extension to certain extensions.

I've requested them to provide a solution if the file can't be uploaded, and they allowed us to upload files as zip.

I wonder what's the point in limiting certain extensions to be uploaded if you can upload them anyway as a zip file. Moreover, what's the point in limiting the allowed extensions if at all, having into account that the best measure to avoid a security problem is to have a antivirus in everyone's computer.

Wouldn't it be better to allow any extension and let that job to the antivirus?

Improve this question
3
  • An Antivirus software can not protect a server from attacks, as they only work reliable for already known malware.
    – Robert
    Mar 18 at 13:17
  • yes, I was refering to protect the user's computers, not the server
    – Raul Luna
    Mar 18 at 13:39
  • 1
    According to multiple surveys, cybersecurity professionals think the most effective method of keeping clients secure is keeping them up-to-date and patched and not antiviruses (which in one survey the cybersecurity professionals have mentioned only in 7% of the cases and they probably meant endpoint protection).
    – Sir Muffington
    Mar 18 at 19:19

1 Answer 1

Reset to default
1

Extensions can be associated with a specific behavior. For example if somebody manages to upload a attack.php and then is able to make the (badly configured) web server use this file when accessing http://example.com/uploadir/attack.php, then the server might not send the file but instead execute the PHP code inside it - i.e. the hacker as achieved remote code execution. And this is just one possible attack.

... the best measure to avoid a security problem is to have a antivirus in everyone's computer.

Antivirus is limited in what it can do, does not solve all security problems and does not even reliably resolve all the security problems it is designed for. Moreover it is not a good idea to rely on a single component and approach for protection, because it might fail due to the inherent limits of the approach, bugs or misconfiguration.

Improve this answer
5
  • I understand the point, but we save the files as BLOB fields in a database, so there isn't any file downloaded in web space
    – Raul Luna
    Mar 18 at 13:08
  • @RaulLuna Blocking .exe, .msi, and .dll files can also protect the users against low effort attacks. Antivirus software can never stop all malwares. Policies blocking some file extensions are generic, as such they need to be adapted to the environment: sometimes they can be ineffective or counter-productive, but most of the time they can be insufficient by themselves and should be completed by other counter-measures.
    – A. Hersean
    Mar 18 at 13:39
  • @RaulLuna: "but we save the files as BLOB fields in a database" - this would be the kind of information which should have been in the question. Anyway, I'm pretty sure that these files are not just stored in the database but that something is done with these files later - the specific attack vectors possible depend on these missing information.
    – Steffen Ullrich
    Mar 18 at 14:53
  • @SteffenUllrich, I've updated the question adding that information also
    – Raul Luna
    Mar 18 at 15:08
  • @RaulLuna: I don't see any information in the question of what actually happens with the uploaded files. But exactly this is relevant to understand if an extension provides some protection or not. It also also not clear what extensions are allowed, so the effectiveness of the protection for whatever the users do with the files (again: unknown) cannot be evaluated.
    – Steffen Ullrich
    Mar 18 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.