XSS attack via unchecked image uploads

If you allow users of your website to upload data (e.g. images), and you display this data to other users, you need to open the file on the server to examine it and check that it really is what it should be (e.g. an image).

Most website software will need to examine the image anyway, to extract thumbnails, determine width/height, etc. In which case, this security comes for free. But I've seen software which doesn't have any such needs, and thus server-side examination is not done.

The reason is:

I was unaware of this before 1 brought this my attention, thanks! More information.

P.S. I recently created a nerdy privacy-respecting tool called When Will I Run Out Of Money? It's available for free if you want to check it out.

This article is © Adrian Smith.
It was originally published on 17 Aug 2010
More on: Security | Web | Software Architecture