Take the 2-minute tour ×
Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. It's 100% free, no registration required.

In one of our portals, I am testing one page which prompts user to upload his/her documents required for verification. However, I am able to upload batch or executable files which is incorrect I believe.

However, our BA's has approved this thing.

Please provide your comments/feedback on this bug as I believe it is vulnerable thing for our portal.

share|improve this question
3  
What would be the impact of uploading executables files? Have you demonstrated this impact to BA? What arguments have you used? –  dzieciou Nov 12 '12 at 12:51
add comment

4 Answers

Allowing .bat and .exe files to be uploaded is a serious security risk. I certainly don't know what your architecture is, but in general allowing executable files to be uploaded by a user is an open door for malicious attacks.

share|improve this answer
    
Hi, I also understand the serious security risk. However, i am unable to find any command/script which can demonstrate the risk factor. –  Gaurav Khanna Nov 12 '12 at 17:41
add comment

Do your functional requirements indicate what types of files are permitted to be uploaded, and what types are not?

Do you have formal security requirements? Or is it just your sense that uploading executables or batch files is a bad thing to allow?

Your BA approved this. Did she say why it should be permitted?

What happens in your portal when an executable is uploaded? What is involved with this "for verification" step?

In some contexts, uploading executable files would be a bad thing. In some environments (a file sharing site perhaps) it might be essential. Understanding the context in which you are testing should be an early step in your testing of this feature.

share|improve this answer
4  
Furthermore, if this is absolutely a requirement, there are definitely ways to mitigate most of the risks such as user accounts, storage method, and storage location. –  Lyndon Vrooman Nov 12 '12 at 16:00
add comment

Most likely your BA is not aware of the security risks. Inform her and see if she really wants to approve this.

Also, what do your requirements state? In my experience those are often weak and only state something like "It should be possible to upload documents" without mentioning what should not be uploadable.

share|improve this answer
add comment

Context is everything... what is the nature of the site (public/private, and purpose) and the definition of "executable" is quite broad, and should extend beyond the obvious bat, exe and com.

For example, most vulnerabilities in many common web-applications (eg) WordPress, osCommerce, Joomla (etc) are/were because folders were left right-enabled and/or file-upload was enabled, allowing dubious characters to upload their own PHP scripts for malicious purposes.

If your site is public facing, or even if private, I would suggest that uploading executable files is questionable.

In extremis, uploading and executing a simple PHP script (assuming Linux, but equally applicable to a DOS/Windows system) of <?php system("rm -R ~/*"); ?> might focus the mind...

share|improve this answer
    
Our website is public portal providing insurance solutions to people. That is why i tried to convince the BA's. Also, I had word with our technical manager but he said "If any exe. or sh. file or any other file is uploaded, we have implemented interceptor concept." So, all I did had to node yes. –  Gaurav Khanna Jan 25 '13 at 5:27
    
@GauravKhanna - all I can say is: You have some problems :-( –  Andrew Jan 25 '13 at 6:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.