0

I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create a pdf with their uploaded file.

My question is if this can pose a threat to the website. I am thinking it could be possible a script is hidden as a image file and once uploaded cause some damage.

Simply using,

<input type="file" accept="image/png, image/jpeg">
3
  • 2
    You talk about uploaded file that stays client side. That's contradictory. May 20, 2022 at 10:40
  • "to the website" -- you might have to define that a little better. What's the subject of the risk?
    – schroeder
    May 20, 2022 at 14:34
  • Is the PDF generated client side or on the server? What happends to the PDF after it is created - is it uploaded to your server or just saved by the user?
    – Anders
    Oct 19, 2022 at 7:44

1 Answer 1

-1

File uploads pose a significant risk. OWASP lists the following risks regarding file uploading:

  • The impact of this vulnerability is high, supposed code can be executed in the server context or on the client side. The likelihood of detection for the attacker is high. The prevalence is common. As a result the severity of this type of vulnerability is high.
  • It is important to check a file upload module’s access controls to examine the risks properly.
  • Server-side attacks: The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, or exploit the local vulnerabilities, and so forth.
  • Client-side attacks: Uploading malicious files can make the website vulnerable to client-side attacks such as XSS or Cross-site Content Hijacking.
  • Uploaded files can be abused to exploit other vulnerable sections of an application when a file on the same or a trusted server is needed (can again lead to client-side or server-side attacks)
  • Uploaded files might trigger vulnerabilities in broken libraries/applications on the client side (e.g. iPhone MobileSafari LibTIFF Buffer Overflow).
  • Uploaded files might trigger vulnerabilities in broken libraries/applications on the server side (e.g. ImageMagick flaw that called ImageTragick!).
  • Uploaded files might trigger vulnerabilities in broken real-time monitoring tools (e.g. Symantec antivirus exploit by unpacking a RAR file)
  • A malicious file such as a Unix shell script, a windows virus, an Excel file with a dangerous formula, or a reverse shell can be uploaded on the server in order to execute code by an administrator or webmaster later – on the victim’s machine.
  • An attacker might be able to put a phishing page into the website or deface the website.
  • The file storage server might be abused to host troublesome files including malwares, illegal software, or adult contents. Uploaded files might also contain malwares’ command and control data, violence and harassment messages, or steganographic data that can be used by criminal organisations.
  • Uploaded sensitive files might be accessible by unauthorised people.
  • File uploaders may disclose internal information such as server internal paths in their error messages.

The extension allow-list in your post is not enough by itself. It is trivial to masquerade a file as a different MIME type for example:

$ echo "text" > /tmp/file.gif
$ file /tmp/file.gif
    /tmp/file.gif: ASCII text
$ echo 'GIF89a; text' > /tmp/file.gif
$ file /tmp/file.gif
    /tmp/file.gif: GIF image data, version 89a, 29706 x 30821

Even if someone could upload a nefarious file in disguise it doesn't mean they could execute it but it is a foothold that you would want to avoid.

Another thing to think about is using a file upload as a denial of service device. Without file size checks in place someone could maliciously upload a huge image that fills up your drive.

References
OWASP Unrestricted File Upload
OnSecurity File Upload Checklist

2
  • 1
    "the file will stay client side" that knocks out most of your threats.
    – schroeder
    May 20, 2022 at 14:39
  • The file command is not relevant for the browser file input box, I think. My quess is that the browser just checks the file extension, so the content of a GIF could be absolutely anything.
    – Anders
    Oct 19, 2022 at 7:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .