News for hackers. Stuff that matters.

A comment on How Uploadcare Built a Stack That Handles 350M File API Requests per Day. Parent comment

Re:How Uploadcare Built a Stack That Handles 350M File API R... by BillinghamJ on Monday August 28, 2017 @01:36PM (#15118450)
How so? Obviously they won’t be executing (or likely even analysing) any of the uploaded content.

Similarly, browsers should not generally be particularly vulnerable to malicious content being loaded with appropriate MIME types in appropriate containers (e.g. <img>)

It sounds like you should be asking how browsers protect users from malicious content. Perhaps you could elaborate?

[ Parent | on HN ]
Re:How Uploadcare Built a Stack That Handles 350M File API R... by koolba on Monday August 28, 2017 @04:59PM (#15120010)
You can perform a denial of service attack on a naive server with a maliciously crafted PNG. Just send a zip bomb and see what happens when it decompressed it. The naive approach will crash the server when it tries to malloc successively larger buffers.

https://www.bamsoftware.com/hacks/deflate.html

[ Parent | on HN ]
Re:How Uploadcare Built a Stack That Handles 350M File API R... by rpearl on Monday August 28, 2017 @02:02PM (#15118700)
They say right in the article that they're doing image resizes on the server, for instance. With a customized library too...Hope it's sandboxed well!
[ Parent | on HN ]
Re:How Uploadcare Built a Stack That Handles 350M File API R... by nametube on Monday August 28, 2017 @02:00PM (#15118684)
Image and Video codecs come under attack quite often see https://blog.sucuri.net/2016/05/imagemagick-remote-command-e...

In this context the image manipulation they do with pillow and the underlying libjpeg would be a potential source of vulnerabilities.

[ Parent | on HN ]
Re:How Uploadcare Built a Stack That Handles 350M File API R... by acdha on Monday August 28, 2017 @05:16PM (#15120143)
Significantly, it's not just libjpeg but every format supported by Pillow (http://pillow.readthedocs.io/en/3.4.x/handbook/image-file-fo...) — many of those vulnerabilities have historically been in obscure formats where the implementation has had far less attention than the mainline JPEG or PNG support.
[ Parent | on HN ]
Re:How Uploadcare Built a Stack That Handles 350M File API R... by mintplant on Monday August 28, 2017 @10:19PM (#15121665)
Yep, I remember multiple smaller art-centric sites getting hit in a wave by an ImageMagick RCE vulnerability. Database dumps, full source leaks, the works. Unsure whether it was the one you linked; it seems more recent than I thought.
[ Parent | on HN ]
Re:How Uploadcare Built a Stack That Handles 350M File API R... by jasiek on Monday August 28, 2017 @01:43PM (#15118528)
Here you go.

https://www.theregister.co.uk/2016/10/24/apple_security_upda...

[ Parent | on HN ]