Skip to content

Latest commit

 

History

History
67 lines (56 loc) · 6.78 KB

threat-modeling.md

File metadata and controls

67 lines (56 loc) · 6.78 KB

Threat Model Analysis for carrierwaveuploader/carrierwave

Threat: Malicious File Execution (RCE)

  • Threat: Malicious File Execution (RCE)
    • Description: An attacker uploads a file with a malicious payload (e.g., a PHP script, shell script, or executable) disguised as a permitted file type (e.g., .jpg, .pdf). The attacker might rename a .php file to .jpg, or embed malicious code within a seemingly harmless file. If the server executes this file (due to misconfiguration or lack of validation), the attacker gains control.
    • Impact: Remote Code Execution (RCE), complete server compromise, data theft, data destruction, further network attacks.
    • CarrierWave Component Affected: Uploader class (general file handling), store_dir configuration, potentially any processing modules (e.g., MiniMagick, RMagick if they are used to "process" the malicious file). validate_mime_type_inclusion, validate_mime_type_exclusion, extension_whitelist, extension_blacklist (if bypassed or misconfigured).
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Strong Content Type Validation: Do not rely on file extensions or client-provided Content-Type. Use server-side validation with libraries like mimemagic to determine the true file type based on content. Prefer whitelisting allowed MIME types.
      • File Signature Validation: Inspect the file's "magic bytes" to verify its type.
      • Filename Sanitization: Use CarrierWave's filename method to sanitize and generate a unique, random filename on the server (e.g., with SecureRandom.uuid). Do not use user-supplied filenames directly.
      • Non-Executable Storage: Store uploaded files in a directory outside the web root and ensure the web server is configured to not execute files from that directory.
      • Disable Unnecessary Processing: If image processing isn't needed, disable it. If it is needed, keep processing libraries updated and use ImageMagick's policy.xml.

Threat: Denial of Service (DoS) via Oversized Files

  • Threat: Denial of Service (DoS) via Oversized Files
    • Description: An attacker uploads an extremely large file (or many large files) to exhaust server resources (disk space, memory, CPU, bandwidth).
    • Impact: Application unavailability, service disruption, potential financial losses.
    • CarrierWave Component Affected: Uploader class (general file handling), validate_size_range (if not used or set too high).
    • Risk Severity: High
    • Mitigation Strategies:
      • Strict File Size Limits: Use CarrierWave's validate_size_range to enforce both minimum and maximum file size limits. Choose limits appropriate for your application's needs.
      • Web Server Limits: Configure the web server (Nginx, Apache) and application server (Puma, Unicorn) to limit the maximum request body size.
      • Rate Limiting: Implement rate limiting to prevent an attacker from flooding the server with upload requests.

Threat: Directory Traversal

  • Threat: Directory Traversal
    • Description: An attacker crafts a malicious filename (e.g., ../../../etc/passwd) to write the uploaded file outside the intended upload directory. This could overwrite system files or allow the attacker to read sensitive data.
    • Impact: System compromise, data loss, data breaches, privilege escalation.
    • CarrierWave Component Affected: Uploader class, store_dir configuration, filename method (if not used correctly).
    • Risk Severity: High
    • Mitigation Strategies:
      • Filename Sanitization: Always use CarrierWave's filename method to sanitize the filename. Generate a unique, random filename on the server-side and never trust user-provided filenames directly.
      • Secure store_dir: Configure store_dir to point to a dedicated directory outside the web root, with appropriate permissions. Do not allow user input to influence store_dir.
      • File Permissions: Set restrictive file permissions on the upload directory and uploaded files (e.g., 0644 for files, 0755 for directories).

Threat: Image Processing Vulnerabilities (e.g., ImageTragick)

  • Threat: Image Processing Vulnerabilities (e.g., ImageTragick)
    • Description: If CarrierWave uses ImageMagick, RMagick, or MiniMagick for image processing, vulnerabilities in these libraries (like "ImageTragick") can be exploited by uploading specially crafted image files.
    • Impact: Remote Code Execution (RCE), server compromise.
    • CarrierWave Component Affected: MiniMagick integration, RMagick integration, process method (if used for image manipulation). validate_processing
    • Risk Severity: High
    • Mitigation Strategies:
      • Keep Libraries Updated: Ensure ImageMagick, RMagick, and MiniMagick are always up-to-date.
      • ImageMagick Policy: Use ImageMagick's policy.xml file to restrict operations and resources.
      • Input Sanitization: Sanitize any user-provided data passed to image processing libraries.
      • Consider Alternatives: Explore alternative image processing libraries.
      • Use validate_processing: Use this callback to check if processing was successful.

Threat: Server-Side Request Forgery (SSRF) via Remote URLs

  • Threat: Server-Side Request Forgery (SSRF) via Remote URLs
    • Description: If CarrierWave is configured to allow uploading files from remote URLs, an attacker can provide a URL pointing to an internal service or a sensitive external resource. The server fetches this resource, potentially exposing internal data or allowing interaction with other services.
    • Impact: Access to internal systems, data exfiltration, denial of service, interaction with external services on behalf of the server.
    • CarrierWave Component Affected: remote_<attribute>_url functionality (where <attribute> is the name of your uploader attribute), validate_download (if not used or bypassed).
    • Risk Severity: High
    • Mitigation Strategies:
      • Disable Remote Uploads: If not essential, disable them.
      • Strict URL Whitelisting: If required, strictly whitelist allowed domains or URLs.
      • Network Segmentation: Isolate the application server from sensitive internal resources.
      • Use validate_download: Use this callback to validate remote URL.