Re: Files upload security considerations

[<c0redump () ackers org uk>]

Hi Alexander,

There are huge security implications of allowing users to upload to a web 
server.  Off the top of my head I'm thinking of things like an evil user 
being able to use a phpshell via an evil .php page.  The list is endless.

However, here are a few links you may find interesting.

http://www.acunetix.com/websitesecurity/php-security-4.htm
http://www.developershome.com/wap/wapUpload/wap_upload.asp?page=security

Again, it depends on whether you're running IIS or Apache as to the 
seriousness of the security risk.

Good luck.

Tom

----- Original Message ----- 
From: Alexander Berezhnoy
To: webappsec () securityfocus com
Sent: Thursday, November 09, 2006 9:12 AM
Subject: Files upload security considerations


Hi!

Recently we have got a new requirement for our system which consists
in allowing customers to send us their scanned documents. In this
connexion, I want to find an information about corresponding security
considerations with.

Namely,

- Ways of file delivery  (HTTP POST, FTP, e-mail)
- Main risks
- Mitigations
- Formats (JPG, GIF, PDF)
- Signatures
- Known and historic vulnerabilities

We use Weblogic and Struts.

I realize, that there is not enough information to make any decision,
but, at least, there sould be some common considerations and "best
practices".

Thanks in advance,
Alexander. 



-------------------------------------------------------------------------
Sponsored by: Watchfire

It's been reported that 75% of websites are vulnerable to attack. That's 
because hackers know to exploit weaknesses in web applications. 
Traditional approaches to securing these assets no longer apply. 
Download the "Addressing Challenges in Application Security" whitepaper 
today, and see for yourself.

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008YTU
--------------------------------------------------------------------------