Security issues in accepting image uploads

Question

What are the major security issues to consider when accepting image uploads, beyond the normal stuff for all HTTP uploads?

I'm accepting image uploads, and then showing those images to other users.

How should I verify, for example, that the uploaded image is actually a valid image file? Are there any known vulnerabilities in viewers that are exploitable by malformed image files for which I should be concerned about accidentally passing along exploits? (Quickly googling seems to show that there once was in IE5/6.)

Should I strip all image metadata to help users prevent unintentional information disclosures? Or are there some things that are safe and necessary or useful to allow?

Are there any arcane features of common image formats that could be security vulnerabilities?

Are there any libraries that deal with these issues? (And/or with other issues like converting progressive JPEGs to normal JPEGs, downsampling to standardize sizes, optimizing PNGs, etc.)

Answer 1

Some things I learned recently from a web security video:

• The nuclear option is to serve all uploaded content from a separate domain which only serves static content - all features are disabled and nothing important is stored there.
• Considering processing images through imagemagick etc. to strip out funny business.
• For an example of what you are up against, look up GIFAR, a technique that puts a GIF and Java JAR in the same file.

Answer 2

The risk of propogation of bugs inside image formatters isn't "exactly" your problem, but you can help anyway, by following the general practice of mapping ".jpg" to your executable language, and processing each image manually (in this way you can do refer checks as well).

You need to be careful of:

• People uploading code as images (.jpg with actual c# code inside)
• any invalid extensions (you check for this)
• People trying to do path-related attacks on you

The last one is what you'll need to be wary of, if you're dynamically reading in images (as you will be, if you follow my first bit of advice).

So ensure you only open code in the relevant folder, and, probably more importantly, lock down the user that does this work. I mean the webserver user. Make sure it only has permissions to read from the folder you are working in, and other such logical things.

Stripping metadata? Sure why not, it's quite polite of you, but I wouldn't be nuts about it.