Yesterday Detectify published a blog post explaining the pitfalls of allowing file uploads on your site. There are many kinds of attacks that a malicious user could target through your file upload system.
In the particular attack, they show you how to use flash to upload a bogus file which can then execute arbitrary code using the victim’s session.
The problem is that flash and SWF files hosted on a domain can execute in the security context of that domain, even when it is embedded on a page in a completely different site. Allowing attacker-controlled uploads makes credentials on that domain, such as CSRF tokens and session cookies vulnerable. There are several solutions to fix this, but the EASIEST way is to just host your file uploads through a separate domain, like https://www.filestack.com/
We take security very seriously and we have tried to implement the best set of features that allows flexibility for our customers while protecting their data. Our Filepicker customers will be happy to know that your site is fully protected against this type of compromise. We have implemented several security feature as outlined on our security page: https://www.filestack.com/docs/concepts/security/
Integrating file uploads into your website can be a very painful process which is why we built https://filestack.com
If you have any questions about whether Filepicker can help your asset upload and delivery needs, reach out to our support team:
Contact Support
Filestack is a dynamic team dedicated to revolutionizing file uploads and management for web and mobile applications. Our user-friendly API seamlessly integrates with major cloud services, offering developers a reliable and efficient file handling experience.
Read More →