Critical ThreatWeb & Injection DefenseCWE-434
Secure File Upload Pipeline: Malware Scanning
Build a secure file upload pipeline utilizing MIME validation, magic bytes checking, ClamAV malware scanning, and S3 sandboxing.
Vulnerability Overview
Unrestricted file uploads can lead to Remote Code Execution (RCE).
Uploading a web shell and accessing it executes arbitrary commands.
Vulnerable Code
file.mv('./public/uploads/' + file.name);Saves file directly without inspection.
Remediated Code
await clamav.scan(file.buffer); s3.upload(file);Scans for malware and stores externally.
Hardening Rules
- 1Verify magic bytes
- 2Rename files upon upload
- 3Store outside web root
Frequently Asked Questions
Are extensions reliable for type checking?
No, attackers easily spoof file extensions. Use magic bytes instead.