I have a program to check if incoming files are in an expected filetype, e.g. PDF. The program first takes a look at the magic number, and determines the file type out of that. The problem is that I still can inject malicious script-files (for example batch-files on windows) by simply putting the magic number in the beginning, which is later ignored in the command line when executing the file. Is there another way to make sure that the file is (in this example) a true pdf-file?

  • What's the threat you're trying to protect from? I'm guessing you're restricting file type to prevent the file from being executed by... whom? The server end? The client end? What? As someone said below, you're likely not going to be able to determine maliciousness of the file based on file content. So expand the problem of what who you're trying to protect and what. – Steve Sether Jun 16 '15 at 16:46
  • @SteveSether: I want to make sure, that my program lets only (in this case) pdfs through its controls, so that for example executables are blocked. The files are send from the server to the client, my program is in between. All files which do not fulfill the requirements should be deleted. – arc_lupus Jun 16 '15 at 20:54

Ensuring a file is the right file type is challenging, and sometimes impossible.

When possible, use a strict file parser.

For a PDF file, use a pdf library or pdf parser to parse the file and reject the file if any parsing issues arise. This can often have real compatibility consequences, since many PDF clients allow malformed PDF documents.

Save the file in a restricted location with restricted permissions

Be sure to save the file in a location that isn't processed by your web server. Ensure the extension is non executable by your webserver. Allow only read access to the file (explicitly deny execute privileges).

Understand what kinds of attacks are made possible by user uploaded files

In the case of a file being uploaded to a server, if non execute precautions are taken, then a malicious file getting past your file parser is mitigated. However, if the file is made available to other users, you may want to use antivirus or scan for known malicious signatures. This blacklist approach is a last resort, but it is a reasonable measure to take.

| improve this answer | |
  • I'd just like to add that even if it is a valid PDF (for example) that doesn't mean it's non malicious, and/or not hiding something (en.wikipedia.org/wiki/Steganography) – Chris Murray Jun 16 '15 at 15:25
  • @ChrisMurray excellent point. Thats why I included the other two sections as well. "Expected file type" is a widely vague definition. – amccormack Jun 16 '15 at 15:30
  • For my current attack variant, a file parser could prevent that. Saving the file to a restricted place is impossible, after my program has no influence on the client, it can only work as a "firewall for files". @amccormack: The program expects a certain type of file (pdf/png/jpg/etc.), and if the incoming file does not match that filetype, the file is deleted. – arc_lupus Jun 16 '15 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.