Re: Files upload security considerations

[ed <edvuln () s5h net>]

On Thu, 9 Nov 2006 12:12:52 +0300
"Alexander Berezhnoy" <alexander.berezhnoy () gmail com> wrote:

> Hi!
>
> Recently we have got a new requirement for our system which consists
> in allowing customers to send us their scanned documents. In this
> connexion, I want to find an information about corresponding security
> considerations with.
>
> Namely,
>
> - Ways of file delivery  (HTTP POST, FTP, e-mail)
> - Main risks
> - Mitigations
> - Formats (JPG, GIF, PDF)
> - Signatures
> - Known and historic vulnerabilities
>
> We use Weblogic and Struts.
>
> I realize, that there is not enough information to make any decision,
> but, at least, there sould be some common considerations and "best
> practices".

the consideration is what happens to the file after upload. getting the
file is simple enough. putting it into a database is one thing, putting
it into /incomming/ is another.

will the file the displayed as part of a webpage?

ideally, remove execute/write permissions to the file, so it's just 444.
ensure the file is owned by nobody.

using http to upload is probably the most reliable method of uploading
data, however, it's quite hard to upload large directories unless the
user packs everything into a tar/zip and the upload processor is zip/tar
aware.

active-ftp requires the user to have port 20 inbound open to their
client box, passive ftp requires the users outbound connection is
permitted to an arbitrary high port range.

chrotted sftp has problems, i have experienced a vuln in this, so i
recommend that if you use it you double, triple check things like the
local system accounts have strong passwords.

-- 
Regards, Ed                      :: http://www.s5h.net
:%s/\t/  /g                      :: proud unix system person
:%s/Open Source/Free Software/g

-------------------------------------------------------------------------
Sponsored by: Watchfire

It's been reported that 75% of websites are vulnerable to attack. That's 
because hackers know to exploit weaknesses in web applications. 
Traditional approaches to securing these assets no longer apply. 
Download the "Addressing Challenges in Application Security" whitepaper 
today, and see for yourself.

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008YTU
--------------------------------------------------------------------------