If someone is able to post on the forum of my website links to executable files (malware) hosted on remote websites: can we say that my website suffers from a security hole ?

  • 2
    When malware links are shared between security professionals, it is often modified to prevent accidential clicks. example: hxxp://site/dragonsbehere.exe - this modification is done as a gesture to keep the recipient safe from what the link leads to. If it is shared with malicious intents, it will surely not be defused like this Jun 4 '14 at 16:01

If you are simply talking about someone posting a link on your forum maliciously (in other words intended to actually hurt the end-user not for sharing between security professionals) I would not necessarily consider it a security hole. I would, however, inform your visitors that they are leaving your site and you have no way of knowing if the site is safe. This is probably the route I would take.

You could also try and a script that would scan the link and make sure it is not an executable using CURL. If I went this route I would probably white-list Content-Types to: html and image types and still display a warning as it is not fool-proof.

Fleche gave a good answer, and I advise you read it too. I would also like to point out that most websites that allow links to other websites do it without any kind of warning. So, you should be okay to do the same. The only places I've seen diferenet are places like oDesk.


A link by itself doesn't do anything. The question is how your webserver reacts to the request.

If the server simply sends the file content to the client, this doesn't cause any trouble (at least for the server). It's just a static file. But if the file gets executed by the server, then you have a problem. This depends on the webserver configuration. For example, a file ending with “.php” might be regarded as a PHP script and run on each request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy