Article ID: 979124 - View products that this article applies to.
This article describes how to configure Internet Information Services (IIS) to allow more-secure file uploads through a Web application. Many Web applications such as Content Management Systems require supporting file uploads to the Web server that uses the Web application. Allowing files to be uploaded to the Web server that uses the Web application has security ramifications for the server, and you must understand all the implications for allowing this. This article guides you through securing your Web application uploads through IIS configuration. If your Web application has an automated installer, you can also incorporate the configuration in this article into your installer.
Note Some Web applications use databases to manage uploaded content. However, this article focuses on applications that use the file system.
Create a separate folder for your uploaded content and change the NTFS file permissions on the upload folderBy doing this, you can configure the behavior of uploaded content differently from the rest of your Web application. Grant the upload folder Read and Write permissions for the IIS worker process identity. For IIS 6.0 in Windows Server 2003, you can use the IIS_WPG user group for this. For IIS 7.0 and later, you can use the IIS_IUSRS user group.
For more information about IIS_WPG, visit the following Microsoft Web page:
Configuring Application Pool Identity in IIS 6.0For more information about IIS_ISURS, visit the following Microsoft Web page:
Understanding the Built-In User and Group Accounts in IIS 7.0For more information about how to help secure files with NTFS permissions, visit the following Microsoft Web page:
Securing Files with NTFS PermissionsNote In some cases, such as when impersonation is used, you would need to give Write access for the authenticated user context as well.
Disallow Script Permissions on the upload folderUploaded content for most Web applications are static content, such as images and documents. Uploaded content is not meant to be content that can be run, such as scripts or executable files. Therefore, it is important not to grant Script Permissions on this folder. Otherwise, users who can upload content can execute scripts in the context of your worker process identity on the server. If your Web application has logic to restrict uploads by file name extensions, you should use this restriction as a secondary measure. You should still make sure that your application’s upload directory has script permissions disabled.
To disable script permissions in IIS Manager User Interface (inetmgr) in IIS 5.x and 6.0, follow these steps:
324068Alternatively, you can disable script permissions by using metabase configuration in IIS 6.0 by setting AccessFlags property’s AccessScript flag to False at the upload directory level. For more information and for sample scripts that can be changed for this use, visit the following Microsoft Web page:
(http://support.microsoft.com/kb/324068/ )How to set IIS permissions for specific objects
AccessFlags Metabase Property (IIS 6.0)To disable script permissions in configuration for IIS 7.0 and later versions, you have to set the accessPolicy flag on the handlers section not to have the Script value.
For more information about how to do this in IIS 7.0 and later versions, visit the following Microsoft Web page:
Configure Request Restrictions for a Handler MappingNote Make sure that you read the Script value for the access flags.
For more information about how to set permissions, visit the following Microsoft Web page:
Securing Sites with Web Site Permissions
The Web application should restrict uploads to authenticated and authorized users onlyThis gives the server administrator the ability to audit uploads through the Web application. In the case a user is trying malicious activity, it gives the server administrator an easy mechanism to keep the application functional while blocking out users who are trying malicious activity. When users can upload scripts and execute them through the Web application, authentication should be required and the IIS application pool identity hosting the Web application should not be an Administrative account.
For more information about how to configure application pool identities, visit the following Microsoft Web pages:
Configuring Worker Process Identities (for IIS 6.0)
Specify and Identity for an Application Pool (for IIS 7.0 and later versions)
Follow security best practices for your Web applicationIt is important to follow security best practices for all parts of your Web application and not just the upload logic. For more information about best practices, visit the following Microsoft Web pages:
Securing IIS 5.0 Resource Guide
IIS 6.0 Security Best Practices
Configuring Security for IIS 7.0
Article ID: 979124 - Last Review: January 5, 2010 - Revision: 2.1