SID-02460: How can we prevent upload of dangerous file types?

Status:	Answered	TWiki version:	6.0.0	Perl version:	5.16.3
Category:	CategorySecurity	Server OS:	RedHat Linux 7.4	Last update:	5 years ago

A manual PEN test of one of our sites flagged that the attachment upload functionality "allows an attacker to upload malicious html files and exe files". Is there currently a way to configure checking of file types and excluding undesirable ones?

If there is no such feature currently, do any known plugins provide this or would it be easy to patch this? Any pointers?

-- TWiki Guest - 2020-12-03

Discussion and Answer

See {UploadFilter} configure setting. Matched filenames are renamed on upload to have a .txt extension appended to it, such as evil.php to evil.php.txt

-- Peter Thoeny - 2020-12-04

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.