Home/ Questions/Q 7008571
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T21:45:10+00:00

What are the security considerations when a server fetches a file from an untrusted

  • 0

What are the security considerations when a server fetches a file from an untrusted domain?

What are the security considerations when resizing an image that you don’t trust with PHPs GD2 library?

The file will be stored on the server machine, and will be offered for download. I know I can’t trust the MIME-Type header. Is there anything else I should be aware of?

I have a webservice that looks like this:

input

An http-URL (or a String that is expected to be a URL)

output

A meta description of the file, or an error if there was one.

The meta description has one of two forms:

  1. It’s an image + a URL to the image on my domain + a thumbnail of the image (generated on and hosted by my server)
  2. It’s not an image + a URL to the file on my domain

update

Concerns that I can come up with:

  1. The remote server is a malicious server that will send tiny bits of information, enough to keep the socket open, but doesn’t do anything useful – like slowloris. I don’t know how real of a threat this is. I suppose it could be easily avoided with timeout + progress check.

  2. The remote server serves something that looks like an image (headers, mime-type) but causes PHP to crash when I load it with GD2.

  3. The server sends a useless or bad MIME-type header. Like text-plain for binary files.

  4. The remote server serves an image with a virus in it. I assume that resizing the image will get rid of the virus, but I will serve the original image if there is no reason to scale.

  5. The remote server serves a file with a virus in it. The file will not be treated as an image so my server will do nothing with it. Nothing will happen until the user downloads, and runs it.

Also, I assume I can trust the users of my service. This is a private application in a situation where users can be held accountable for bad behavior. I assume they wont intentionally try to break it.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    What are the security considerations when a server fetches a file from an untrusted domain?

    The domain (host) and the file is not to be trusted. This spreads over two points:

    1. Transport
    2. Data

    To transport the data safely, use a timeout and a size limit. Modern HTTP client libraries offer both of that. If the file could not be requested in time, drop the connection. If the file is too large, drop the data. Tell the user that there was a problem getting the file. Alternatively let the user handle the transport to that server by using the users browser and javascript to obtain the file. Then post it. Set the post limit with your script.

    As long as the data is untrusted you need to handle it with caution. That means, you implement yourself a process that is able to run different security checks on the file before you mark it as “safe”.

    What are the security considerations when resizing an image that you don’t trust with PHPs GD2 library?

    Do not pass untrusted data to the image library then. See the step above, bring it into a safe state first.

    The file will be stored on the server machine, and will be offered for download. I know I can’t trust the MIME-Type header. Is there anything else I should be aware of?

    I think you’re still at the point above. How to come to safe from untrusted. Sure you can’t trust the Content-Type header, however it’s good to understand it as well.

    You want to protect against the Unrestricted File Upload Vulnerability­OWASP.

    1. Check the filename. If you store the data on your server, give it a safe temporary name that can not be guessed upfront and that is not accessible via the web.
    2. Check the data associated with the filename, e.g. the URL information of the source of that file. Properly handle encoding.
    3. Drop anything that does not meet your expectations, so check the pre-conditions you formulate strictly.
    4. Validate the file data before you continue, for example by using a virus checker.
    5. Validate the image data before you continue. This includes file-headers (magic numbers) as well as that the file-size and file-content is valid. You should use a library that has specialized for the job, e.g. an image-file-format-malformation-checker. This is specialized software, so if this part of your business get into business. Many free software image file code exists, I leave this just for the info, you can’t trust any recommendation anyway and need to get into the topic.
    6. If you plan to resize the image yourself, you need to make everything double-safe, because next to hosting you plan to process the data. So know what you do with the data first to locate potential fields of problems.
    7. Do logging and monitoring.
    8. Have a plan for the case that everything get’s wrong.
    9. Consider to repeat the process for already existing files, so if you change your procedure, you are able to automatically apply the principles to uploads that were done in the past as well.
    10. Create a system for each type of work that is able to be cleaned after the work has been done. One system to do the download, one system to obtain the meta data etc.. After each action, restore the system from an image. If a single components fails, it won’t be left over in an exploited state. Additionally if you detect a fail, you can take your whole system out of business until you have found the flaw.

    All this depends a bit how much you want to do, but I think you get the idea. Create a process that works for you knowing where improvement can be added, but first create an infrastructure that is modular enough to deal with error-cases and which probably encapsulates the process enough to deal with any outcome.

    You could delegate critical parts to a system that you don’t need to care about, e.g. to separate processing from hosting. Additionally, when you host the images the webserver must not be clever. The more stupid a system is, the less exploitable it is (normally).

    If hosting is not part of your business, why not hand it over to amazon s3 or similar stores? Your domain can be preserved via DNS settings.

    Keep the libraries you use to verify images with up-to-date (which implicates you know which libraries are used and their versio, e.g. the PHP exif extension is making use of mbstring etc. pp. – track the whole tree down). Take care you’re in the position to report flaws to the library maintainers in a useful way, e.g. with logging, storing upload data to reproduce stuff etc..

    Get knowledge about which exploits for images did exist in the past and which systems/components/libraries (example, see disclaimer there) were affected.

    Also get into the topic which are common ways to exploit something, to get the basics together (I’m sure you are aware, however it’s always good to re-read some stuff):

    Some related questions, assorted:

    • 0