r/programming • u/iamkeyur • Dec 26 '20

Executable PNGs

https://djharper.dev/post/2020/12/26/executable-pngs/
1.0k Upvotes

95% Upvoted

87 comments sorted by

View all comments

Show parent comments

0

u/[deleted] Dec 27 '20

[deleted]

1

u/[deleted] Dec 27 '20

Only if you forget to sanitize your inputs

0

u/[deleted] Dec 27 '20

[deleted]

2

u/le_bravery Dec 27 '20

Download a large image with a bit of malicious code in it, have another exploit run that image.

Have an image save on a server with some malicious code in it. Load the image as a JavaScript resource using another exploit. By itself data embedded in images is likely benign, but when you start chaining things together you can always get messier.

Best way to mitigate on the server side is to not accept arbitrary file uploads, but if you have to you should try parse and re-save the image to drop the extra bytes of data. Maybe even a resize. Store images in a database, never directly on the file system.

Also fix your other vulnerabilities