Upload a virus using a webform

Question

Is it possible to upload a virus to a remote computer using a webform? If yes how do we prevent this from happening assuming we are limiting file types to just images?

Answer 1

you can't - even images may contain malware. http://news.cnet.com/JPEG-exploit-could-beat-antivirus-software/2100-7349_3-5388633.html

Answer 2

You could scan them with ClamAV after upload to ensure everything was ok. I think there are wrappers for most programming languages.

Answer 3

Yes, it is possible. But it relies on the remote computer (the server) to execute some part of the upload. This is relatively rare, but if you can not avoid executing the upload you should virus check the upload or run the image in a sandbox.

Obviously, your server could be vulnerable to some form of attack using the HTTP POST method - follow your chosen HTTP server's mailing list for any vulnerability like this.

Answer 4

I might be stating the obvious here, but you could scan all files with a virus checker when they have been uploaded?

Answer 5

The best way to avoid problems with user uploaded files of any kind is to have a command line virus scanner on the server, which you use to scan the files after upload. If the scanner result is positive, delete the file, record their IP address and inform the user.

It's a pain to setup first time but it's a life saver.

Answer 6

just limiting filetype wont help much .. .

coz virus this days can infect any files .. doc to psd anything..

May used think about using AV for Server .. one such product can be found here

http://www.f-secure.com/en%5FEMEA/products/business/servers/anti-virus-for-servers/index.html

Answer 7

As I understand, you have a computer with an ASP.NET webserver that has a webform where you can upload files. And you are afraid that someone might upload a virus?

Well, unless you execute the file in some way, there is very little risk. It's just going to sit on your disk as a bunch of bytes.

Now, there is a very small chance that if you somehow process the image (say, resize it), and the processing software has a specific bug that the attacker knows about, then he could hijack the process with a carefully crafted image. But guess how big that risk is.

A few ways to reduce that risk even further are:

• Keep the processing software up to date;
• Run the processing software as a separate process with very few privileges (sandbox/virtual machine?), and kill it (and its child processes) if it takes too long;
• Run the uploaded files through an up-to-date anti-virus software.
• Don't use .NET/GDI/GDI+ processing functions (which are popular and people are trying to hack), but use some small 3rd party software (which nobody bothers to hack) that has all the necessary routines (image reading, writing and processing) re-implemented itself.

Although, honestly, I don't think the risk is large enough to worry about it.

Answer 8

Just a thought. If possible, wouldn't a recompression/rescaling etc to the image corrupt the virus and make it non functional?

Answer 9

First, note that it's unlikely that your server will be affected by a virus as it isn't going to be trying to "view" these files (unless you're doing something specific). So the main concern is to keep other users safe when they view these files.

If you're running the images through some sort of resize process (maybe to make them not-so-big so they download in a reasonable amount of time) then you are inherently creating a new image, which you can be fairly confident is free of viruses. This is a great way to ensure that the image is really an image and that it is free from malicious content.