Enhanced File Upload Security

Overview

CyberStore 2024.2 strengthens file upload processing with request authentication, file-content validation, malware scanning, and safeguards for uploaded filenames and directories.

What Changed

CyberStore now validates file uploads before making them available to the application. The upload handler verifies the authenticated request, configured file extension and size, declared MIME type when enforcement is enabled, and the file’s content signature.

Supported Microsoft Office Open XML documents receive additional inspection. Macro-enabled Office documents and documents containing configured prohibited archive entries are rejected.

CyberStore also:

  • Rejects executable, script, installer, server-side source, and other dangerous file types through a non-configurable denylist.
  • Checks double extensions, such as program.exe.pdf, for prohibited inner extensions.
  • Sanitizes filenames to prevent unsafe filename use and path traversal.
  • Preserves existing files by adding a numbered suffix instead of overwriting a matching filename.
  • Scans uploaded files with Windows Defender and deletes files when a threat is found or scanning cannot complete.
  • Applies additional restrictions to upload directories to prevent uploaded content from executing.

Standard Supported File Types

The standard configuration permits PDF, JPEG, PNG, and Microsoft Word, Excel, and PowerPoint Open XML documents:

File type Extensions
PDF .pdf
JPEG image .jpg, .jpeg
PNG image .png
Microsoft Word .docx
Microsoft Excel .xlsx
Microsoft PowerPoint .pptx

The standard individual file-size limit is 10 MiB.

The effective upload size limit is the smallest limit imposed by the CyberStore upload configuration, ASP.NET, or IIS.

Upgrade Impact

Existing custom upload workflows should be tested after upgrading. A file accepted by an earlier version can now be rejected because its type, MIME information, file signature, Office document contents, malware-scan result, authenticated request, or effective size limit does not satisfy the enhanced validation rules.

The upgrade also removes the obsolete ConsoleFileUpload.ashx endpoint and the temporary FileUpload.ashx rewrite rule used by the earlier in-place security patch.