I have a small website on which users can upload several types of files: images, zip files ... (except .exe files). Suppose a user uploads via the front end interface of my website a picture which is infected: will this picture be hosted without a problem on mywebsite or are they antiviruses/scanners hosted on the server on which i host mywebsite that check this ?

  • 1
    How can we know which hosting provider you use? But generally yes, it will be hosted and served. Hoping for some AV to be out there is just too optimistic. – Dmitry Janushkevich Jul 23 '14 at 7:22

If your upload form are not secured and not verified lots of things about the files wich is trying to be uploaded on your server , yes you can upload an infected image. You intercept the http header like tamper data or other tools , and you can modify the extension of your file and other parameters : example : http://exploiterz.blogspot.fr/2013/07/how-to-upload-sh3ll-using-firefox-adon.html

For the AV scan that's depends on the shell that you upload i think.

I hope this helps you , sorry my english is not very well.


Many things can go wrong with file uploads. If by "infected" images, you mean images which will trigger arbitrary code execution on your visitors' machines, I'd say that you're probably okay (but an antivirus sweep can't hurt).

However, there are other things to look for when implementing an image-hosting website (or a file hosting website). You said that executable files are not allowed, but how about PHP files? An attacker could upload a script, guess where it is located on your website and have your server execute if, effectively taking control.

This SANS blog entry lists some of the things you should do to secure your file upload script:

  • Create a new file name for the uploaded files so an attacker can't predict where his file will end up on the system.
  • Do not put the uploads in your document root. This is the only way you can control the access to the uploads.
  • File extensions are not to be trusted: check the Content-Type header (or a more advanced code based on magic numbers and file formats) instead if you want to prevent some file types from being uploaded to your server.
  • Limit the number of uploads in order to prevent denial of service attacks, or even inconsiderate users from filling your hard drive.
  • Try to keep track of who uploads what. This way, if something goes wrong, you'll have some basis for your investigation.

You can't rely that there is any antivirus/scanner that would block them. If you want to check the files with an antivirus, you must run it yourself in your uploader.

Zip files are specially dangerous, since they could upload a .zip containing a .exe, a .zip that is an infected Office document, a .zip which when called by java runs a virus…

There are also files matching multiple types, such as the GIFAR vulnerability, so you not only need to check that it is of the expected type, often you also need to check it's not one of the blacklisted ones.

Moreover, in addition of you providing the proper Content-type header, the browser must not guess a dangerous MIME (an example would be treating a safe text/plain as text/html, which could then run dangerous javascript), something IE has made specially hard, by sometimes overriding the server instructions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy