Common Security Risks in File Upload and Sharing Platforms
Common security risks in file upload and sharing platforms stem from unrestricted file intake and uncontrolled delivery. Intake risks include malware injection, active content execution (e.g., malicious scripts in SVG/HTML), and denial-of-service via resource exhaustion. Sharing risks include broken access control, permanent or guessable links, and data leakage via unstripped EXIF metadata.
A user uploads a file, and a week later someone else opens it from a link. Every step between those two moments is a place where the feature can be abused.
The common security risks in user file upload and sharing platforms fall into two groups. Upload risks are malicious files (malware, scripts hidden in SVG or HTML, files that claim to be one type and are another) and uploads large or numerous enough to exhaust your servers. Sharing risks are share links that never expire or can be guessed, missing per-file access checks, files served from your...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
