3 ms·
Serious question: do any "real" web applications which allow you to upload images not re-encode the image before saving it to disk? I thought this was industry
by chias 10y ago
Serious question: do any "real" web applications which allow you to upload images not re-encode the image before saving it to disk? I thought this was industry standard.
There's a whole host of issues associated with not doing this, including potentially unwanted exif data, and e.g. just cat'ing a jpeg with a rar file and using the image host as an arbitrary file host, etc.
- xnyhps 10y agoRe-encoding is not enough to prevent attackers from constructing polyglots, see https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/ https://www.idontplaydarts.com/2012/06/encoding-web-shells-i... > Placing shells in IDAT chunks has some big advantages and should bypass most data validation techniques where applications resize or re-encode uploaded images. You can even upload the above payloads as GIFs or JPEGs etc. as long as the final image is saved as a PNG. An attacker will likely be able to figure out the exact re-encoding you apply, so unless you add some form of randomness, the attacker can work backwards to get the payload they want included.
- djsumdog 10y agoAt a minimum, most sites strip all exif an identifying information. Most also pump it through something like ImageMagick or GraphicsMagik (and if you can find sites using old versions of graphics libraries with known exploits, that's another issue) to resize and recompress. Even with that, I'm sure this is an attack vector on a lot of sites that don't bother with these simple sanity checks. It's a really cool little example though.