Yesterday Detectify published a blog post explaining the pitfalls of allowing file uploads on your site. There are many kinds of attacks that a malicious user could target through your file upload system.
In the particular attack, they show you how to use flash to upload a bogus file which can then execute arbitrary code using the victim’s session.
The problem is that flash and SWF files hosted on a domain can execute in the security context of that domain, even when it is embedded on a page in a completely different site. Allowing attacker-controlled uploads makes credentials on that domain, such as CSRF tokens and session cookies vulnerable. There are several solutions to fix this, but the EASIEST way is to just host your file uploads through a separate domain, like https://filepicker.io/
We take security very seriously and we have tried to implement the best set of features that allows flexibility for our customers while protecting their data. Our Filepicker customers will be happy to know that your site is fully protected against this type of compromise. We have implemented several security feature as outlined on our security page: https://developers.inkfilepicker.com/docs/security/
Integrating file uploads into your website can be a very painful process which is why we built https://filepicker.io
If you have any questions about whether Filepicker can help your asset upload and delivery needs, reach out to our support team at firstname.lastname@example.org or 877-888-8161.