Enhanced File Upload Security
Overview
CyberStore 2024.2 strengthens file upload processing with request authentication, file-content validation, malware scanning, and safeguards for uploaded filenames and directories.
What Changed
CyberStore now validates file uploads before making them available to the application. The upload handler verifies the authenticated request, configured file extension and size, declared MIME type when enforcement is enabled, and the file’s content signature.
Supported Microsoft Office Open XML documents receive additional inspection. Macro-enabled Office documents and documents containing configured prohibited archive entries are rejected.
CyberStore also:
- Rejects executable, script, installer, server-side source, and other dangerous file types through a non-configurable denylist.
- Checks double extensions, such as
program.exe.pdf, for prohibited inner extensions. - Sanitizes filenames to prevent unsafe filename use and path traversal.
- Preserves existing files by adding a numbered suffix instead of overwriting a matching filename.
- Scans uploaded files with Windows Defender and deletes files when a threat is found or scanning cannot complete.
- Applies additional restrictions to upload directories to prevent uploaded content from executing.
Standard Supported File Types
The standard configuration permits PDF, JPEG, PNG, and Microsoft Word, Excel, and PowerPoint Open XML documents:
| File type | Extensions |
|---|---|
.pdf | |
| JPEG image | .jpg, .jpeg |
| PNG image | .png |
| Microsoft Word | .docx |
| Microsoft Excel | .xlsx |
| Microsoft PowerPoint | .pptx |
The standard individual file-size limit is 10 MiB.
The effective upload size limit is the smallest limit imposed by the CyberStore upload configuration, ASP.NET, or IIS.
Upgrade Impact
Existing custom upload workflows should be tested after upgrading. A file accepted by an earlier version can now be rejected because its type, MIME information, file signature, Office document contents, malware-scan result, authenticated request, or effective size limit does not satisfy the enhanced validation rules.
The upgrade also removes the obsolete ConsoleFileUpload.ashx endpoint and the temporary FileUpload.ashx rewrite rule used by the earlier in-place security patch.
Related Guidance
- File Upload Security Configuration for server-side upload validation and configuration.
- File_FileUploader Widget for widget-level upload options.
- ItemReturnForm Widget for return-attachment options.