Pushing Left, Like a Boss – Part 5.5 File Uploads

Allowing files to be uploaded to your applications (and therefore your network) is the most high-risk activity an application can do. It is truly a dangerous thing.

If you decide to include file uploads in your applications, you should:

1. Scan all uploaded files with an application to analyze the files for malicious characteristics such AssemblyLine (free from the Canadian Government, can be installed locally so you do not need to share your files with a 3rd party), Cylance, FireEye or Virus Total.

2. Buy a third party tool to do this work for you.

3. If buying a third party tool is not possible, follow the advice in the OWASP File Uploads cheat sheet when you create your own.

Here are some points to take home, as summarized from the OWASP File Uploads Cheat Sheet, written by Dave Wichers:

· Ensure the application is receiving the expected file type which is within an acceptable size range. If not, reject it.

· If possible, avoid accepting Zip files. If you must accept zip files, be extremely careful.

· Rename the file, do not use user-supplied information to name the file, even temporarily.

· Do not allow the user to specify a path to save the file, always have the application decide, and do not share this location with the end user.

· Pay special attention to files with double file extensions and ensure the fake extension is removed. For example: myfile.php.txt would become systemcreatedfilename.txt.

· Use image processing libraries to verify the image is valid and to strip away extraneous content.

· Set the extension of the stored image to be a valid image extension based on the detected content type of the image from image processing (do not trust the header from the upload).

· Ensure the detected content type of the image is within a list of defined acceptable image types (jpg, png, etc).

· Ensure that you can attribute the file to the authenticated and authorized user that uploaded it for auditing purposes. It is not advised to let unauthenticated users to upload files.

· It is preferable to save files to a to properly secured blob storage, then a database or to a file system. If on a file system, ensure it is on a file server (not the web server), preferably isolated and/or on a different domain/network zone, in a directory that does not have any execute permissions and has had all the script handlers removed. If at all possible store it in the cloud in blob storage instead.

Many thanks to the OWASP Cheat Sheets Project leaders (Jim Manico and Dominique Righetto) and to the many project contributors, who have taught me much of what I know today.