5 ms·
> what other choice do they have but to fetch it? They could not fetch it and have a little blank bit in the thumbnail. Chances are they're using a library th
by MiguelHudnandez 13y ago
> what other choice do they have but to fetch it?
They could not fetch it and have a little blank bit in the thumbnail.
Chances are they're using a library they didn't develop and did not think of the possibility of external resources being loaded.
Edit: The most secure way I can think to handle preview generation is to have a virtual machine firewalled from the internet that previews a single document and is then reverted.
- Kudos 13y agoIt makes more sense to have it fetch them via a proxy.
- fleitz 13y agoFetching via a proxy really doesn't do much, all you lose is the originating IP of the machine, the rest of the vulnerability still works. If you're thinking of egress filtering except for the proxy, you can just HTTP tunnel right through it.
- MiguelHudnandez 13y agoAlso there's a possibility of processing embedded links which point at your internal network. "How did this HTTP GET go through to my 'firewalled' PHPmyadmin site?" You have to treat all user input as if it's toxic.
- fleitz 13y agoBrilliant! I wonder what kind of error messages LibreOffice embeds when it can't fetch a resource... could map out the internal network pretty quickly if it has distinct error messages. Also docx files are zip files which opens the possibility of a zipbomb. I wonder if LibreOffice has protection for zipbombs.
- badman_ting 13y agoThat's what I was thinking too. The only thing is that this process is running on an AWS instance, so it would have to be on Dropbox's VPN or something to have any such access. Either serendipitously or intentionally, I hope these boxes don't have any connection to anything sensitive.
- fleitz 13y agoDocker would probably be better as you don't have the huge VM overhead and is naturally reverts to it's original state.
- MiguelHudnandez 13y agoI agree -- It's the same concept but much more efficient. I'd set up a docker to accept a single HTTP post with the document, and to return the thumbnail. The docker can then be shut down and a new instance spun up to wait for the next document to process. It might be wasteful to spin up a new docker for each instance, but it's the only way to prevent some exploit in LibreOffice[1] that might leak information somehow. A leak could be as terrible as embedding an entire document in the next thumbnail, or as simple as returning the wrong thumbnail (like from a previous request). [1] LibreOffice was the user-agent that phoned home in the article.