File upload security best practices: Block a malicious file upload

We need to allow our customers to upload files for one of our Web applications. What are the security implications of allowing users to upload files on our website?

The ability to upload files on a website is a common feature, often used to enable users or customers to upload documents and images. While this is useful in many situations, the security implications of hosting a file-upload facility are significant. Here are some file upload security best practices.

Malicious file uploads
An ordinary user may use the facility to upload the type of files expected. However, an attacker could take advantage of the facility with malicious file uploads.

There are two fundamental ways a website can be attacked by a file upload. The first way involves the type of file uploaded. A file could overwrite another file that already exists with the exact same name on the server. If this were a critical file, the new file could cause the website to function incorrectly, or not at all. The new file could be used to deface the website by replacing an existing page, or it could be used to edit the list of allowed file types in order to make further attacks simpler.

The second way a website could be attacked by a malicious file upload involves the content of the uploaded file. The uploaded file could contain malicious code in the form of an exploit, virus, Trojan or malware, which could be used to gain control of the Web server. For example, it is possible to hide PHP code inside an image file and still have it appear to be an image. When the image is opened, it also executes the code hidden in the file. The file could contain scripts or tags that exploit other well-known Web application vulnerabilities, such as cross-site scripting (XSS).

Alternatively, the file space of the Web server could be exhausted by the attacker uploading a huge file.

If the uploaded file can be accessed by entering a specific URL path, it could be especially dangerous because the file could be executed immediately after uploading.

Defending against file upload attacks
There are six steps to protecting a website from file-upload attacks.

1. The application should use a whitelist of allowed file types. This list determines the types of files that can be uploaded, and rejects all files that do not match approved types.
2. The application should use client- or server-side input validation to ensure evasion techniques have not been used to bypass the whitelist filter. These evasion techniques could include appending a second file type to the file name (e.g. image.jpg.php) or using trailing space or dots in the file name.
3. The application should set a maximum length for the file name, and a maximum size for the file itself.
4. The directory to which files are uploaded should be outside of the website root.
5. All uploaded files should be scanned by antivirus software before they are opened.
6. The application should not use the file name supplied by the user. Instead, the uploaded file should be renamed according to a predetermined convention.

While these techniques cannot guarantee a website will never be attacked from a malicious file upload, they will go a long way toward protecting the website while still providing users with the benefits of uploading files when needed.