3

If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF exploits, and I get that someone could perhaps host one of those on my server, but I mean it's not like they can access cookie data or anything through a PDF file. So is this fine to do, or should I be worried?

Should I have them host the files under a different domain name, or am I fine using my original domain?

I've noticed, for example, that a lot of websites like Facebook, Google, YouTube etc. have special domain names for hosting images and other data they allow users to upload, so I'm curious.

  • 1
    Facebook, Google et al uses another domain for static content because the servers hosting images can be lightweight servers, not a full-blown webserver. And they can host static content all around the world. – ThoriumBR Sep 19 '14 at 20:15
  • @ThoriumBR Oh ok, so then would it be fine of me to allow users to upload pdf/rtf/doc files under my domain? – jake192 Sep 19 '14 at 20:17
  • In reference to abacabadabacaba's comment, review this video: vimeo.com/103938583 A simple jpg upload functionality contributed to an internal domain controller being compromised. – k1DBLITZ Sep 22 '14 at 20:19
4

The problem is not that the files could contain exploits, but that they can be made to cause harm when reinterpreted as a different format. For example, someone may upload a file with RTF extension, which is actually a Flash file which is designed to steal cookies or perform CSRF attacks. That's one of the reasons Google hosts all user-provided files on a separate domain, so that the main domain is isolated from such content by same-origin policy.

0

Immediate danger - no.

Potential danger - yes: to anyone's system who is accessing these files. Virus scanning can mitigate some of this risk but is far from perfect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.