0

I want an authenticated user to upload an excel file to our web application. The Excel file will be parsed to generate structure.

Security is important, so we'll need to prove that we follow best practices. However, the file will be uploaded only to Blob Storage (Azure) and we will parse it with dot net libraries.

I feel that most of the security vulnerabilities and best practices described by owasp here https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html are applicable only if you upload a file to a real operating system.

Am I right? I would probably check only content type, extension and size, why would I care about other threats? I understand that my application could "pass" a malicious file, but I don't think that our application could be compromised in any way.

In addition, isn't there any Azure service that can scan blob storage files, I would really like to save development efforts

Improve this question
2
  • you'll want to check for vulnerabilities in the libraries you use to parse the excel file. XSLX are XML based, so the basic header stuff is in play there. (DTD lookups, etc...)
    – browsermator
    Commented Nov 16, 2023 at 21:32
  • If you assume your code has zero vulnerabilities you may as well assume it's written by invisible pink unicorns.
    – vidarlo
    Commented Jul 13 at 19:14

1 Answer 1

Reset to default
0

Some, non-exhaustive, high-level thoughts to add to the ones you mention:

  1. ensure the upload mechanism itself cannot be abused (CSRF), to say upload to an arbitrary destination
  2. contemplate the consequences of an exploitable, arbitrary execution vulnerability in the parsing code. Can you limit blast radius, should such a weakness be found?
  3. always best practice to rename files to eliminate attacker control over that piece
  4. what happens to data after parsing, could the attacker provided data be dangerous at some later point?
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .