4 ms·
Getting permissions on a single website user context is already enough considering the vast amount of user uploaded images on the modern internet. It's a bit li
by sigmoid10 3y ago
Getting permissions on a single website user context is already enough considering the vast amount of user uploaded images on the modern internet. It's a bit like XSS on steroids, because it is not limited to one site or frontend.
- londons_explore 3y agoWell websites are stupid if they don't reencode user-uploaded images for precisely this reason... Otherwise an evil client uploads a malicious webp image, which then gets hosted and 'shared' by the server to other users, who upon viewing said image get exploited and share more malicious images...
- masklinn 3y agoUnless you mean the client should transcode before upload (which they can, mind) that mostly makes the server exploitable.
- mortehu 3y agoYou'd set up the server so that it's okay if it gets exploited. For example, maybe its only job is decoding images.
- jiofj 3y agoThen transcode in a different server. Not transcoding user-uploaded files is borderline negligent.
- account42 3y agoTranscoding images is why all old pictures on the web a a blocky mess of unholy JPEG.
- londons_explore 3y agoThere are ways to transcode images in such a way that if they're downloaded and reuploaded to your service you don't lose any further quality in your re-upload.
- kroltan 3y agoAs someone who shared a good deal of Spore creations over the internet, I disagree. (The game would generate a "card" with a visual preview, but would stuff the XML encoding of the creation into some PNG metadata field so the image could be dragged onto someone else's game.)
- dns_snek 3y agoThe server is usually processing the images anyway, at the very least to remove EXIF metadata, but also to resize and compress the images for different resolutions.
- nocsi 3y ago100% Websites that accept complex media from users really are stupid. It’s bad enough sanitizing other input, but the added costs with transcoding and storing user content, all the meanwhile exposing unnecessary risk to processes. I’d just pipe the media upload to Cloudflare and have them deal with it
- saagarjha 3y agoReencoding images doesn’t mean they’re not exploitable anymore.
- Jigsy 3y agohttps://xkcd.com/1683/ https://xkcd.com/1683/
- insanitybit 3y agoThe idea here would be that I'm visiting Reddit, someone uploads a malicious WebP, and now my Reddit account is owned, right?
- ffpip 3y agoSites like Reddit load user uploaded content from different domains (redditmedia.com) so you should be safe in this case.
- IshKebab 3y agoI'm not that familiar with Chrome's process isolation but I think that the renderer process that displays your Reddit.com tab would still render that image, even if it came from a different domain. Chrome doesn't spin up another process to render the image and then transfer the pixels.
- spookthesunset 3y agoWouldn’t the exploit code be able to bypass all those cross domain checks? As long as they are running in the same sandbox, right?
- PhilipRoman 3y agoIt should be noted that some sites (not sure about reddit) will re-encode images in various ways (sometimes to entirely different formats), possibly mitigating this. Exploits aside, there are quite a few undesirable behaviours you can cause with media, such as the bouncing video file which changes it's height every frame and makes content around it reflow.
- insanitybit 3y agoTBH I just used Reddit as an example of "site with images", I'm not actually concerned about my Reddit account/ think it'd be a good target.