Zach Moshe Rotem Naar

 File upload vulnerabilities overview  FUV – detailed overview  Live demonstration  In the future…

 Many applications take advantage of the band width available today and allow users to upload file, either for storage or usage within the flow of the software. This allows the software to be more appealing and interactive with the user  The uploaded file is a “jack in the box”. It may convey all sorts of trouble within, from viruses to extremely large sizes

Safe file upload principals

 Check file type ◦ Avoid dangerous extensions ◦ Validate MIME-type Module

 Use random filename ◦ Avoid XSS attacks ◦ Avoid file inclusion attacks Module Utility

 Keep upload directory security Module

 Scan file with AntiVirus Module

 Limit file size ◦ Avoid DoS attack Module Utility

Design and Details

 Java package, which exposes an API that allows file validation through a single validate(file) method  The application is configured by an XML file that the caller supplies. Only relevant modules will be enabled  Utilities for application developer  Using Java 1.6

FUV package Validation modules Utils After the file is uploadedBefore/While uploading the file Validation modules

FileValidator > boolean Validate(File) FileValidator > boolean Validate(File) FileValidatorImpl Module > boolean Validate(File) Module > boolean Validate(File) File Type Module File Type Module File Name Module File Name Module UNIX File Permissions Module UNIX File Permissions Module Anti virus Module Anti virus Module *

 The primary interface of the system ◦ public boolean validate(File file)  Holds set of modules  Returns true if all configured modules approved the file according to their configuration  If at least one of the modules rejected the file, the method returns false

 Open archive/compressed files and check the inner files using the modules  In case one of the inner files is archive/compressed file too, the same operation is done recursively  The maximum file depth allowed is configured in the XML configuration file  Opens archive/compressed files using Apache-Commons-Compress package  Supported formats: ZIP, TAR, GZIP, BZIP2

 The main operation:  public boolean validate(File file)  All modules have:  “scanInnerFiles” attribute (“true” by default)  unique configuration  In case “scanInnerFiles” is “true” and the validated file is archive/compressed file, the module will scan the inner files too

 Validates file types according to a predefined set of accepted MIME types (white-list validation)  Uses Apache-Tika package for content analysis of the file  Configuration: ◦ Allowed types ◦ Force extension check

 Can be enabled only in UNIX environment  Validates that the file on the server has the appropriate permissions  The module is configured by 3 “maximal” allowed permissions for the user, group and all (similar to UNIX file permissions)  Using ls UNIX command

 Validates filename strings  Configuration: ◦ Filename length ◦ Allowed character strips – from the strips configured in the system (white-list validation)

 Uses an external program as an AntiVirus  Approves/Rejects the file according to its return code  Configuration: ◦ AntiVirus path ◦ Success return code  We’re using Clam-AV

FileValidator Module File True False

FileValidator Module File True False True If archive/comressed: Foreach inner file: send to validation False

FUV package Validation modules Utils After the file is uploadedBefore/While uploading the file Utils

SizeBoundedInputStream extends InputStream Read() hasReachedLimit() SizeBoundedInputStream extends InputStream Read() hasReachedLimit() FileNameGenerator String generateNewRandomFilename() String censorFilename(String filename) FileNameGenerator String generateNewRandomFilename() String censorFilename(String filename)

 Allow the user generate safe filenames  Contains 2 methods: 1.censorFilename(String fileName) Censors given filename: limits the filename length and removes not-allowed characters Configuration:  filename length  Allowed characters strips 2.generateNewRandomFilename() Generates random filename according to the configured pattern Configuration: filename pattern

 Creates safe way to upload a file without a problem with its size  Extends InputStream and warps the original InputStream  In case the number reached the maximum allowed, it returns -1 (EOF) and set the limitReached flag to “true”  Configuration: maximum size allowed

 Configure engine, modules and utilities parameters Application Name 7 … … 1024 … …

50 D C O bin/av_wrapper.sh 0 word text application/x-gzip rwx r-x

application/x-tika-msoffice application/msword application/x-tika-ooxml application/vnd.openxmlformats- officedocument.wordprocessingml.document application/vnd.openxmlformats- officedocument.wordprocessingml.template application/rtf text/plain

:51:01,859 INFO [main] c.a.f.c.FileValidatorImpl [FileValidatorImpl.java:63] Validating file : C:\tmp_rotem\tmp\out.zip :51:01,859 DEBUG [main] c.a.f.c.FileValidatorImpl [FileValidatorImpl.java:68] Validating module com.amdocs.filevalidator.modules.FileNameModule :51:01,875 DEBUG [main] c.a.f.m.FileNameModule [FileNameModule.java:61] File name length (excluding extension) is 3. Maximum length allowed: :51:01,875 DEBUG [main] c.a.f.m.FileNameModule [FileNameModule.java:81] Allowed chars: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_-)( :51:01,875 DEBUG [main] c.a.f.c.FileValidatorImpl [FileValidatorImpl.java:68] Validating module com.amdocs.filevalidator.modules.FileTypeModule :51:01,875 DEBUG [main] c.a.f.m.FileTypeModule [FileTypeModule.java:61] FileTypeModule was called for out.zip :51:01,875 DEBUG [main] c.a.f.m.FileTypeModule [FileTypeModule.java:65] AllowedTypes are {application/x-tika-msoffice=[doc], image/jpeg=[jpg, jpeg], text/plain=null, application/x-bzip2=null, application/x-gtar=null, application/vnd.openxmlformats- officedocument.wordprocessingml.document=[docx], application/msword=[doc], application/x-gzip=null, application/x-tika-ooxml=[docx], application/zip=null} :51:02,296 DEBUG [main] c.a.f.m.FileTypeModule [FileTypeModule.java:90] content type is application/zip :51:02,296 DEBUG [main] c.a.f.m.FileTypeModule [FileTypeModule.java:93] forcing ext check :51:02,343 INFO [main] c.a.f.c.FileValidatorImpl [FileValidatorImpl.java:110] Found ZIP file :51:02,343 INFO [main] c.a.f.c.FileValidatorImpl [FileValidatorImpl.java:323] Entry: cfvxcbcf.txt …

 XML Configuration – using JAXB  Logging - using SLF4J and LogBack  Unit Testing  Code Examples  Building the project – using Maven  Version Control – using SVN  JAR, sources and documents can be found on:

Validate files using FUV package

How to improve the project

 Add support in client side (JavaScript/PHP packages)  Add module for special treatment to images (malicious code inside image)  Create secure upload server using the FUV package  DoS Attack – limit the size and number of files one user can upload in a given period (track the user using cookies or IP)