Use octet stream downloads
Summary
The system should download files coming from untrusted sources, such as user-uploaded files, using octet stream downloads.
Description
User-uploaded files should generally be considered to be untrusted input. If the appropriate Content Security Policy is not set when opening a file, browsers may render it and interpret potentially malicious code. Therefore, user-uploaded files should be served by either octet stream downloads, or from an unrelated domain, such as a cloud file storage bucket. This reduces the risk of XSS vectors or other attacks from the uploaded file.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- CAPECâ„¢-19. Embedding scripts within scripts
- CAPECâ„¢-165. File manipulation
- CWEâ„¢-138. Improper neutralization of special elements
- CWEâ„¢-646. Reliance on file name or extension of externally-supplied file
- CWEâ„¢-1021. Improper restriction of rendered UI layers or frames
- OWASP TOP 10-A3. Injection
- PA-DSS-5_2_7. Cross-site scripting (XSS)
- CMMC-CA_L2-3_12_2. Plan of action
- CMMC-SI_L1-3_14_5. System & file scanning
- HITRUST CSF-01_h. Clear desk and clear screen policy
- HITRUST CSF-09_j. Controls against malicious code
- FedRAMP-CA-2_2. Security assessment - Specialized assessments
- FedRAMP-SI-3. Malicious code protection
- ISA/IEC 62443-IAC-1_13. Access via untrusted networks
- ISA/IEC 62443-SI-3_2. Malicious code protection
- ISA/IEC 62443-RDF-5_3. User content filtering
- OWASP SCP-12. File management
- OWASP ASVS-12_2_1. File integrity
- OWASP ASVS-12_3_6. File execution
Vulnerabilities
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.