CODEWITHSUNDEEP
asp.netsecurityfile-uploadwebforms
Farshid
Farshid

Reputation: 5364

How to be sure about an uploaded file is not a virus in ASP.net?

I saw this question:

ASP.NET File Upload: how can I make sure that an uploaded file is really a JPEG?

and similar questions about being sure of the file being uploaded through asp:FileUpload control in ASP.net is really image. But What If users upload virus-infected images? How can I be insured of the image files being uploaded via my ASP.net application does not affect the files in my web app folder and/or images uploaded by other users?

Upvotes: 2

Views: 3857

Answers (4)

Rzassar
Rzassar

Reputation: 2282

As a side note, In older version of IIS (6 or prior versions) It could be possible to change FileName to the real malicious file name after save the file with original filename. Which has possibility to be read and execute regularly by the server.
E.G. set the file name like: file.asp;.jpg or file.asp%00.jpg etc...
It also has a possibility to change target directory by manipulation of file name. Which is extremely dangerous
E.G. newfolder.asp::$Index_Allocation or etc...
There is also some new way of attacks. Read more here.

Upvotes: 1

Eric Fleischman
Eric Fleischman

Reputation: 1158

I'll take what is likely a somewhat controversial position.

There is no way to know with 100% certainty what the intent of a file is, be it good or evil. It is impossible. AV scanners give you a slice of data but they can't give you 100% guarantees either. No one can.

Given this reality, you need to build your app assuming that all files uploaded are bad. Yes, scanning is still fine and will filter out a bunch of stuff. But it will never be 100%. Is it 99.999% or 20%? Who knows. Does it really matter?

I would build any app today assuming that all user supplied content is bad. Very bad. Hostile bad. Because eventually it will be if you make it. And when it is, you'll be ready for them...rather than all the people that have to rearchitect their app because they made bad assumptions early on.

With a bit more data about your exact concerns, I'd be happy to comment on them more specifically...

Upvotes: 1

matt-dot-net
matt-dot-net

Reputation: 4244

As long as you don't serve it back to anyone as anything other than an image (content-type) and never trying to execute (.exe) the file you'll be fine.

Upvotes: 2

Daniel A. White
Daniel A. White

Reputation: 190966

Most anti-virus software run whats known as an "on-access scan". That is, when a file is changed, it automatically scans that file.

So save that file to the file system and let your server's anti-virus software do the work for you.

Upvotes: 1

Related Questions