Convenience aside, allowing anonymous visitors to upload files to your site is pretty much like opening the gates and telling malicious users it is okay to compromise your server. This puts you, the website owner, in a very tough position when considering that such permissions have become a commonality on today’s internet and has proven to increase business efficiency.
Having the ability to upload files is a regular occurrence on social networking sites such as FaceBook, MySpace and Twitter as well blogs, forums and online banking sites. This feature is also prevalent in corporate portals as it allows end-users to share files with business employees. In these environments, users are permitted to upload documents, pictures, music, videos and several other types of files. The more functionality an end-user is provided with, the greater the probability of creating a vulnerable web application. It is a known fact that many internet users abuse their privileges to gain access to a specific site or compromise a web server.
During recent tests, security experts have discovered that an alarming number of widely used web applications are not making use of secure upload forms. According to their findings, many of these vulnerabilities were easily detected and exploited, allowing experts to gain full access to the file system on the web server hosting those applications. Most of these vulnerabilities were the direct result of improper security configurations, essentially permitting intruders to roll right in.
Below is a list of practices you or your system administrator should enforce when file uploads are allowed to your website or web applications:
– Create an .htaccess file that only permits access to files with allowed extensions
– Do not the put the .htaccess file in the same directory where the files uploaded by users will be stored. This file should be stored in the parent directory that your visitors do not have access to.
– The average .htaccess file that only allows files such as jpg, jpeg, gif and png files should include the following lines:
< files ~ "^\w+\.(gif|jpe?g|png)$">
allow from all
These lines can be adjusted to suit your own personal needs. Editing the .htaccess file in this manner will not only assure that only these file types are allowed, but also protect you from double extension attacks.
– If at all possible, make sure the files uploaded by users are placed in a directory outside of the server root.
– Do not allow existing files to be overwritten. This will prevent exploits such as the .htaccess overwrite attack.
– Do not rely solely on client-side validation. This is simply not enough to ensure an adequate level of security. It is advisable to implement both client-side and server-side validation.
There are several ways a malicious user can bypass the security configurations applied to a file upload form. When incorporating such a feature into your web applications, you should make it a priority to follow the best security practices and put them to the test on a regular basis. While this requires a considerable amount of security expertise, it is worth every bit of time to make sure your website is protected.