Review the project documentation to identify what file types are considered acceptable, and what types would be considered dangerous or malicious.Identify the file upload functionality.While these are considered safe, if an attacker is able to upload executable code (such as a PHP script), this could allow them to execute operating system commands, read and modify information in the filesystem, access the back end database and fully compromise the server. ExampleĪ common example of this vulnerability is an application such as a blog or forum that allows users to upload images and other media files. Malicious files could be detected and stopped at various points of the application architecture such as: IPS/IDS, application server anti-virus software or anti-virus scanning by application as files are uploaded (perhaps offloading the scanning using SCAP). The application may allow the upload of malicious files that include exploits or shellcode without submitting them to malicious file scanning. Additionally, this is different from uploading unexpected files in that while the file type may be accepted the file may still be malicious to the system.įinally, “malicious” means different things to different systems, for example malicious files that may exploit SQL server vulnerabilities may not be considered as “malicious” in an environment using a NoSQL data store. Vulnerabilities related to the uploading of malicious files is unique in that these “malicious” files can easily be rejected through including business logic that will scan files during the upload process and reject those perceived as malicious. Although many sites implement simple restrictions based on a list of permitted (or blocked) extensions, this is not sufficient to prevent attackers from uploading legitimate file types that have malicious contents. Although input validation is widely understood for text-based input fields, it is more complicated to implement when files are accepted.
Many application’s business processes allow users to upload data to them.
Home > Latest > 4-Web Application Security Testing > 10-Business Logic Testing Test Upload of Malicious Files ID
0 kommentar(er)
