4

I'm working on a site that has CMS functionality. I'm considering allowing users to upload Flash (.swf) files and then displaying them on my site.

  • Is this a bad idea?
  • Is there a way to do this safely?
  • What are the worst things that can happen, both to my servers and to visitors of my site?
  • What precautions can I take to mitigate these issues?
  • what's the use case for uploading swf files? – schroeder Feb 4 '15 at 23:59
  • You can think of my service a site builder, similar to wix.com. Users can upload content that will be shown on their site. Some users want to have Flash content on their site. – Alex Grin Feb 5 '15 at 0:13
  • Ah, ok. Then the potential problems of uploading a malicious swf file rests on their shoulders. – schroeder Feb 5 '15 at 0:19
  • Is content specific to user site only or it can be published publicly for all users ? If not, Legitimate users could be affected if a non-legitimate user uploads a malicious file. – ciphercodes Feb 5 '15 at 0:24
  • Good point. There is some crossover. One user can create a blog post on their site that will be aggregated to other sites in their "network". – Alex Grin Feb 5 '15 at 13:28
6

Older versions of flash .swf's contain vulnerabiltiies. A user could upload a clip created with an older version of Flash CS and thus expose hundreds of end users. If they don't have the latest flash player (and many don't), they could catch a nasty bug.

The .swf could be triggered to launch a cross-site injection that deploys an IFRAME within the user's browser window. Then it's game over. This blog post explains how it happens. http://blog.sucuri.net/2014/11/malicious-injector-in-swf-adobe-flash-file.html

Code that launches external JS

Yup. The actionscript contained within the .swf could launch a javascript housed on another website and cause someone to get a virus just by visiting yours.

None of the AV's in 2014 detected the badware. As a former Flash developer, I have since moved to Canvas HTML5/ jQuery as it works in mobile. See this example. It is fully compliant http://careerbuildermedia.com/atx/projects/portillos/pjb/code6/

In older browsers such as IE8 it fallsback to the equivalent flash player. The expertise to do this is high, but if you really want to support swf uploads you need a moderating process to remove the ones that aren't up to spec.

  • 1
    Older versions contain vulnerabilities, not exploits, per se. – schroeder Feb 5 '15 at 0:42
3

It depends on how your site works. Flash allows you to call javascript, which allows the flash developer to access cookies as well as the DOM for the same origin the site was served up for.

So if you're allowing users to serve up an SWF file on your domain, that means anyone visiting your clients page could do a XSS (cross site scripting) attack if your client used the same origin as your site does. i.e. if you allow users to put swf files on www.yoursite.com/clientdirectory, you're really owned at that point since any client could grab authentication cookies.

If your site is merely a hosting site and the URLs are never shared between you and other clients, i.e. your site allows clients to post flash to www.theirsite.com, there's really no special issues with swf files than with a normal javascript.

0

Any time that you allow users to upload files that other users can access, you introduce the possibility that a user could upload a malicious file. Flash, in particular is vulnerable to many different types of vulnerabilities.

There would be no risk to your server because the swf file is downloaded to clients and run there.

You could attempt to scan the swf files for malware, but that will only offer limited protection.

0

A while ago there was a Windows server vulnerability that was due to flaws in previewers that were triggered by search indexing mechanisms run on the server. That allowed an attack that was present in the uploaded media file to also infect the server. Both JPG and TTF previewer flaws were exploited by different kinds of malware. So it's historically been possible for a user provided file to not only attack other users, but unattended servers, too.

These flaws have long ago been fixed, of course. But they're an important reminder to be really careful with uploaded content, because you can pretty much expect vandals to upload infected files.

Older Flash files are known for having serious vulnerabilities. You could try validating the uploaded files, making sure they're a current version. The tool Blitzableiter is a Flash conformity tester that tries to fix dangerous incompatibilities, you could consider testing all uploaded software with it before allowing it to be served.

-1

Unless you want to allow the additional interactivity afforded by flash, then yes go ahead allow them to upload. A large portion of the flash based net games work only because of this.

However if you're only interested in providing streaming, then why not just video uploads? mp4, h264, vp8 etc. You're responsible for the users that visit the site, so being a wateringhole is not a good idea.

  • The OP has a site-builder, so the requirement is coming from the user's themselves. This doesn't really answer the question. – schroeder Feb 5 '15 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.