0

I want an authenticated user to upload an excel file to our web application. The Excel file will be parsed to generate structure.

Security is important, so we'll need to prove that we follow best practices. However, the file will be uploaded only to Blob Storage (Azure) and we will parse it with dot net libraries.

I feel that most of the security vulnerabilities and best practices described by owasp here https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html are applicable only if you upload a file to a real operating system.

Am I right? I would probably check only content type, extension and size, why would I care about other threats? I understand that my application could "pass" a malicious file, but I don't think that our application could be compromised in any way.

In addition, isn't there any Azure service that can scan blob storage files, I would really like to save development efforts

1
  • you'll want to check for vulnerabilities in the libraries you use to parse the excel file. XSLX are XML based, so the basic header stuff is in play there. (DTD lookups, etc...) Nov 16, 2023 at 21:32

1 Answer 1

0

Some, non-exhaustive, high-level thoughts to add to the ones you mention:

  1. ensure the upload mechanism itself cannot be abused (CSRF), to say upload to an arbitrary destination
  2. contemplate the consequences of an exploitable, arbitrary execution vulnerability in the parsing code. Can you limit blast radius, should such a weakness be found?
  3. always best practice to rename files to eliminate attacker control over that piece
  4. what happens to data after parsing, could the attacker provided data be dangerous at some later point?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .