What is File Upload?

Almost all websites need to collect files from users. Whether you are supporting a company website or building a social media site, you need to create an easy-to-use file upload form to accept content from users. This can be implemented using technologies such as JavaScript file upload, PHP file upload, or Laravel file upload.

However, accepting user-generated content exposes your website to risks such as malware, unauthorized server access, data theft, and illegal file hosting.

As organizations move to remote workspaces, it becomes increasingly important to implement measures to secure file uploads, to protect against file upload vulnerabilities and mitigate potential attacks.

What Is the Impact of File Upload Vulnerabilities?

A file upload vulnerability allows a web server to upload a file to the file system without properly validating the user's identity, the file type, content, size, etc. Even a basic image upload function that does not have proper restrictions can allow attackers to upload any file, including potentially dangerous files. In extreme cases, attackers might upload server-side script files that allow remote code execution, leading to complete takeover of the server.

The impact of a file upload vulnerability generally depends on two important factors:

• Aspects of a file that the website cannot properly identify, such as file size, format, and content.
• Limitations imposed after a file upload is successful, such as ability to execute the file.

If the file type is not validated properly, and the server configuration allows certain types of files (such as .php and .jsp) to run as code, an attacker can simply upload a server-side script that acts as a web shell, granting full control over the server.

If the file name is not properly validated, an attacker can upload a file with the same name as an existing file, overwriting sensitive files. If your server is also vulnerable to directory traversal (allowing attackers to change directories in an unauthorized manner), this could allow an attacker to upload files to an unexpected location.

If file size is not properly validated, the attacker can use a form of denial of service (DoS) attack by filling the victim’s available disk space with uploaded files.

File Uploading Storage and Security Considerations

Safe Uploads

To mitigate file upload risks, start by securing the file upload form. File upload security best practices include:

• Use a whitelist of allowed file types—this is a list that determines which types of files can be uploaded and rejects any unauthorized file types. Never allow executables, because they can be used to run malicious code on the server.
• Check file types against a whitelist before allowing uploads.
• Scan all uploaded files with multiple anti-malware tools.
• Set maximum and minimum file sizes to avoid DoS attacks.
• Set up SSL encryption to secure data passed between the web server and browser.
• Ensure regulatory compliance—depending on the applicable compliance standards, your upload form might need to comply with GDPR, EU-US Privacy Shield, PCI (News - Alert) DSS, or other standards and regulations.

File Storage Location

The location where you want to store your files should be chosen based on your security and business requirements. Here are some important configurations:

• Save the file to another host—this allows for complete separation of responsibility between the application that serves users and the host that handles file uploads and storage.
• Keep files outside of the web root directory—the web root directory should only be accessible for those with administrative access. If you store any files to the web root directory, ensure the application only has permission to write new files, not to modify, delete, or execute any files.
• Carefully control read access—in most cases, the application used to upload files will not need read access. If you need read permission, set controls carefully to prevent attackers from stealing data and performing reconnaissance on the server.

An alternative to file storage is to store files in a database. This can help with automated backup processes, prevent non-file system attacks, and resolve various permission issues. However, it can be slower than file-based access, and requires a database administrator on the team. Also, databases have their own vulnerabilities, such as SQL injection.

Cloud Storage Security

Cloud storage providers include the world’s top cloud computing platforms (for example, see this in-depth blog post about Microsoft Azure storage), dedicated storage services like Dropbox (News - Alert), and smaller independent providers. In some cases, cloud storage can be more secure than on-premises infrastructure, but not all cloud storage platforms are secure.

Look for the following features in a cloud storage platform:

• Redundancy—the provider should offer redundant hardware and software mechanisms to support disaster recovery scenarios.
• Robust physical security—the provider’s data center should be much more secure than a typical office server room. Common measures include 24-hour facility surveillance, fingerprint locks and armed guards.
• Multi-tiered security features—the provider should use state of the art firewall technology to filter traffic to and from cloud storage, intrusion detection systems (IDS), and other security solutions as applicable.
• High-end security testing—cloud providers should run regular vulnerability assessments and penetration tests to verify storage servers are secure.
• Continuous monitoring—providers should offer security teams real-time visibility into all servers and cloud storage in a facility.

Conclusion

In this article, I discussed some of the key considerations facing developers and administrators who add file upload functionality to web applications. File upload is a useful feature for users, but can create severe security risks for the organization.

There are three primary ways to improve security of file upload functionality:

• Secure uploads mechanisms with proper validation of file type, file name, and file size.
• Ensuring files are saved to a secure location - preferably not the web root directly, and if possible, on a completely different host from the web server.
• Using a cloud storage provider with robust security practices.

I hope this will be useful as you improve the security posture of your web applications.