Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm working on a site that has CMS functionality. I'm considering allowing users to upload Flash (.swf) files and then displaying them on my site.
Older versions of flash .swf's contain vulnerabiltiies. A user could upload a clip created with an older version of Flash CS and thus expose hundreds of end users. If they don't have the latest flash player (and many don't), they could catch a nasty bug.
The .swf could be triggered to launch a cross-site injection that deploys an IFRAME within the user's browser window. Then it's game over. This blog post explains how it happens. http://blog.sucuri.net/2014/11/malicious-injector-in-swf-adobe-flash-file.html
Yup. The actionscript contained within the .swf could launch a javascript housed on another website and cause someone to get a virus just by visiting yours.
None of the AV's in 2014 detected the badware. As a former Flash developer, I have since moved to Canvas HTML5/ jQuery as it works in mobile. See this example. It is fully compliant http://careerbuildermedia.com/atx/projects/portillos/pjb/code6/
In older browsers such as IE8 it fallsback to the equivalent flash player. The expertise to do this is high, but if you really want to support swf uploads you need a moderating process to remove the ones that aren't up to spec.
It depends on how your site works. Flash allows you to call javascript, which allows the flash developer to access cookies as well as the DOM for the same origin the site was served up for.
So if you're allowing users to serve up an SWF file on your domain, that means anyone visiting your clients page could do a XSS (cross site scripting) attack if your client used the same origin as your site does. i.e. if you allow users to put swf files on www.yoursite.com/clientdirectory, you're really owned at that point since any client could grab authentication cookies.
If your site is merely a hosting site and the URLs are never shared between you and other clients, i.e. your site allows clients to post flash to www.theirsite.com, there's really no special issues with swf files than with a normal javascript.
Any time that you allow users to upload files that other users can access, you introduce the possibility that a user could upload a malicious file. Flash, in particular is vulnerable to many different types of vulnerabilities.
There would be no risk to your server because the swf file is downloaded to clients and run there.
You could attempt to scan the swf files for malware, but that will only offer limited protection.
A while ago there was a Windows server vulnerability that was due to flaws in previewers that were triggered by search indexing mechanisms run on the server. That allowed an attack that was present in the uploaded media file to also infect the server. Both JPG and TTF previewer flaws were exploited by different kinds of malware. So it's historically been possible for a user provided file to not only attack other users, but unattended servers, too.
These flaws have long ago been fixed, of course. But they're an important reminder to be really careful with uploaded content, because you can pretty much expect vandals to upload infected files.
Older Flash files are known for having serious vulnerabilities. You could try validating the uploaded files, making sure they're a current version. The tool Blitzableiter is a Flash conformity tester that tries to fix dangerous incompatibilities, you could consider testing all uploaded software with it before allowing it to be served.
Unless you want to allow the additional interactivity afforded by flash, then yes go ahead allow them to upload. A large portion of the flash based net games work only because of this.
However if you're only interested in providing streaming, then why not just video uploads? mp4, h264, vp8 etc. You're responsible for the users that visit the site, so being a wateringhole is not a good idea.
