1

Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a MS Word document of some PR example text, or a PDF of their CV, etc.

Some files will be blacklisted for security reasons, e.g. .zip files, .exe files and .php files.

What about flash files? Is there any security concerns if I was going to host .swf files and automatically play them?

<?php
if ($extension == 'swf') {
    echo '<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,19,0" width="640" height="430">
       <param name="movie" value="/'.$urlToFLV.'" />
       <param name="quality" value="high" />
       <param name="wmode" value="transparent">
       <embed wmode="transparent" src="/'.$urlToFLV.'" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="400" height="430"></embed>
    </object>';
}
?>

I guess the flash code is executed in the users browser, so if there was a security issue, it would be on their machines, not our server?

Improve this question
1
  • This seems like a question that is more appropriate to StackOverflow, as opposed to here. Regarding the question, though, I have no idea about how this could be used to compromise the server, and I don't even know flash, but a few things that I would point out as obvious security concerns are flash's ability to take screenshots, copy the clipboard, communicate with other servers, etc. I find this idea troubling in the sense that there are so many security vulnerabilities that it would be impossible to prevent them all. Good luck... and sorry that I can't be of more help!
    – Michael
    Commented Jan 27, 2011 at 8:21

3 Answers 3

Reset to default
4

I do know flash and yes this is a terrible idea! This is what started all the trouble for myspace with self replicating virus worms. It's really simple, with flash I can get your browser to make all sorts of calls/connections/login to sites/post things as you/etc. It's amazing how much you can pull off a user with flash and report it back to any server/location on the web.

Do not let your users upload/post flash unless you plan to have them send you the .fla file and you're going to code review it and compile it yourself.

Improve this answer
2
  • Hrmmm... I wonder how Flash game sites like Newgrounds work. Do they analyze the .fla file of every game posted? One alternative is to host all user flash movies from a subdomain so as not to allow any CSRF attacks.
    – Lèse majesté
    Commented Jan 27, 2011 at 15:54
  • Decompilers allow you to look at the code and see if it's making any malicious calls outward or trying to sniff user data. They do require games to go through a review phase before they post them publicly. Letting someone directly upload/post flash immediately opens you up to this problem if you're not reviewing it.
    – XOPJ
    Commented Jan 27, 2011 at 15:59
1

I would say yes there are security considerations of allowing users to upload flash files.

The security issues may not be internal - by that I mean a threat to your server, but if your website is hosting flash files which can comprimise a users machine, or something equally nasty then your likely to experience problems building/maintaining a user-base or community.

Improve this answer
1
  • 1
    By the way, if he (Tom) were to visit a page containing a malicious flash app and get a root kit installed b/c of it, they could then access the files on his computer and run executables on it, acquiring his log-in usernames and passwords, thus accessing the server... so it's potentially possible that the server can be compromised, at the very least, by proxy, if not directly.
    – Michael
    Commented Jan 27, 2011 at 10:01
1

I'm not a Flash programmer, and I know that Flash has a weird way of handling cookies/sessions (I think it uses your IE sessions regardless of which browser the plugin is being run from), but you may still have some potential CSRF/XSS problems.

The problem I foresee is a user uploading a malicious Flash movie that can then be used to launch CSRF attacks when embedded from any domain. If the Flash movie gets embedded in a page in your domain, then an XSS attack can be launched.

And, although not related to uploading Flash files, you may also want to prevent users from uploading a crossdomain.xml file. This file is normally placed in your domain root, but it can also be used from arbitrary locations if you specify it in the flash movie.

And as Michael mentioned, malicious Flash movies can also be dangerous to user computers. I'm not sure if the latest version has any open remote code execution vulnerabilities, but Flash has a pretty poor record. I would be very careful about allowing users to upload Flash movies. You may want to look into some kind of AV scanner that can detect malicious Flash files.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.