Is it necessary to scan users' file uploads by antivirus?

Question

Web application allows users to upload files. Is it necessary to scan those files by antivirus?

I'd want to hear answer in two scenarios:

Type of file isn't checked when uploading. They are stored in folder that isn't directly accessible from the internet. Files don't have permissions to execute. Then user may query some url, and files will be returned with Content-Disposition: attachment
Type of file isn't checked when uploading. It's contents is parsed with some HTML/XML/JSON/etc. parser. After parsing file isn't stored at server

In case 1, beware of pranksters submitting EICAR and then having the download get rated by their anti-virus program. All alarm bells probably go off and your domain is blocked for everybody using that AV, or at least that happened to me once... Only I uploaded it myself so I wouldn't have to look EICAR up all the time. I figured I'd better move it to a private directory :P — Luc, Nov 01 '12 at 20:04
Nobody mentioned an important detail: threat model. In your threat model, are the people uploading these files considered to be potential attackers? If so, then #1 is a must. — Mark E. Haase, Nov 02 '12 at 01:41

score 6 · Answer 1 · answered Nov 01 '12 at 10:06

6

I see no reason to use a virus scanner in the second case. The chances of a code-execution vulnerability in an anti-virus seem larger than that of a vulnerability in my parsing libraries. Especially if the parsing libraries are written in a memory safe language.

In the first case I'd use an anti-virus, since offering virus files for download doesn't sound like a good idea. Both people and automated website reputations systems(for example google safe browsing) might associate virus downloads with your website hurting its reputation.
I might still offer such a file for download, but only after an explicit warning and user confirmation. Preferably a confirmation that prevents bots from downloading it.

answered Nov 01 '12 at 10:06

CodesInChaos

11,964
2
40
50

I agree that anti-virus is over kill but perhaps running some kind of normalization on the data before passing it to the parser might reduce risk. – Andy Smith Nov 01 '12 at 18:16
What parsers are written in memory-safe languages? Most HTML, XML, and JSON is parsed in C or C++ code. – Mark E. Haase Nov 02 '12 at 01:40
@mehaase For example JSON.net and Html Agility Pack are written in C#. – CodesInChaos Nov 02 '12 at 10:58

score 4 · Answer 2 · answered Nov 01 '12 at 09:46

4

In scenario 1, you can safely assume that the content will not be executed on the server, and the user will be forced to download the file rather than viewing it in their browser. This is reasonably safe from your point of view, because you offload the responsibility of checking the file to your users.

In scenario 2, I'd definitely run it through an AV. Your parser library might have a vulnerability, so you most definitely want to do some basic checks before handing it off to the library.

answered Nov 01 '12 at 09:46

Polynomial

133,763
43
302
380

2

It doesn't seem more likely that my parser library contains a vulnerability than that the anti-virus contains a vulnerability. – CodesInChaos Nov 01 '12 at 09:54
Some well known parser libraries like nokogiri have very low number of vulnerabilities ever found so I'm not sure defense in depth is necessary – Andrei Botalov Nov 01 '12 at 09:57
1

Sure, but by that logic nobody should ever check anything. – Polynomial Nov 01 '12 at 09:57
2

Would typical COTS antivirus software be able to detect parser exploits? – Stephen Touset Nov 01 '12 at 19:12
A firewall might catch the payload as it moves across your network, but the AV isn't likely to unless it hits disk. – Polynomial Nov 02 '12 at 06:55

score 1 · Answer 3 · answered Nov 01 '12 at 09:47

If someone asked you to carry a sealed package as part of your luggage on a commercial flight, would you?

Even if you're just providing a respository for users to store their own files rather than re-publishing the uploaded content, it would be reckless to accept anything that is thrown at your server.

However AV scanning is not the only way to protect against malware - verifying the mimetype and using a lossless conversion method to switch between formats can neutralise a large proportion of threats (e.g. convert jpg to png, MSWord doc to pdf*). If you have implemented your own parser for the file and it's a basic format such as XML, then you're already verifying the contents - AV scanning is probably overkill. But like all code, it should be secure.

*) but not using MSWord to do the conversion!

Good suggestion to convert files first, but I think that doesn't work in this case. There is no way you could do this for all possible filetypes. — Luc, Nov 01 '12 at 22:43

score 1 · Answer 4 · answered Nov 01 '12 at 17:32

Type of file isn't checked when uploading. They are stored in folder that isn't directly accessible from the internet. Files don't have permissions to execute. Then user may query some url, and files will be returned with Content-Disposition: attachment

Scanning before delivering the attachment is just the courteous thing to do, but there are lots of things that are problematic to store but which will pass a virus scan just fine.

This may be a tad paranoid, but if you wouldn't intentionally write software that lets people plant evidence that incriminates you, don't unintentionally write software that does that.

What kind of information do you log about the uploaders? Might you have enemies who would upload child pornography or bomb-making plans to your server and then send an anonymous tip to the police?

Type of file isn't checked when uploading. Its content is parsed with some HTML/XML/JSON/etc. parser. After parsing the file isn't stored at server.

Anti-virus scanners are unlikely to be helpful here. Same question as above. Can you sanity check the information you extract from the files or prove that whatever information you store came from an external source?

I never understood that part. If a site like Google Drive or Drop Box gets files with illegal contents, how does it protect itself? — AturSams, Jun 11 '14 at 10:40
@ArthurWulfWhite, many legal systems have some protections for [common carriers or public carriers](http://en.wikipedia.org/wiki/Common_carrier#Legal_implications). — Mike Samuel, Jun 11 '14 at 11:12

Is it necessary to scan users' file uploads by antivirus?

4 Answers4

Linked