Note Some Web applications use databases to manage uploaded content. However, this article focuses on applications that use the file system.
Create a separate folder for your uploaded content and change the NTFS file permissions on the upload folderBy doing this, you can configure the behavior of uploaded content differently from the rest of your Web application. Grant the upload folder Read and Write permissions for the IIS worker process identity. For IIS 6.0 in Windows Server 2003, you can use the IIS_WPG user group for this. For IIS 7.0 and later, you can use the IIS_IUSRS user group.
For more information about IIS_WPG, visit the following Microsoft Web page:
For more information about IIS_ISURS, visit the following Microsoft Web page:
For more information about how to help secure files with NTFS permissions, visit the following Microsoft Web page:
Note In some cases, such as when impersonation is used, you would need to give Write access for the authenticated user context as well.
Disallow Script Permissions on the upload folderUploaded content for most Web applications are static content, such as images and documents. Uploaded content is not meant to be content that can be run, such as scripts or executable files. Therefore, it is important not to grant Script Permissions on this folder. Otherwise, users who can upload content can execute scripts in the context of your worker process identity on the server. If your Web application has logic to restrict uploads by file name extensions, you should use this restriction as a secondary measure. You should still make sure that your application’s upload directory has script permissions disabled.
To disable script permissions in IIS Manager User Interface (inetmgr) in IIS 5.x and 6.0, follow these steps:
- Click Start, and then click Run.
- Type inetmgr in the Open box, and then click OK.
- In the tree view in the navigation pane, select the path of the upload directory of your Web application.
- Right-click this path, and then click Properties.
- Click the Directory tab, and then select None in the Execute Permissions list.
Alternatively, you can disable script permissions by using metabase configuration in IIS 6.0 by setting AccessFlags property’s AccessScript flag to False at the upload directory level. For more information and for sample scripts that can be changed for this use, visit the following Microsoft Web page:
accessPolicy flag on the handlers section not to have the Script value.
For more information about how to do this in IIS 7.0 and later versions, visit the following Microsoft Web page:
Note Make sure that you read the Script value for the access flags.
For more information about how to set permissions, visit the following Microsoft Web page:
The Web application should restrict uploads to authenticated and authorized users onlyThis gives the server administrator the ability to audit uploads through the Web application. In the case a user is trying malicious activity, it gives the server administrator an easy mechanism to keep the application functional while blocking out users who are trying malicious activity. When users can upload scripts and execute them through the Web application, authentication should be required and the IIS application pool identity hosting the Web application should not be an Administrative account.
For more information about how to configure application pool identities, visit the following Microsoft Web pages:
Follow security best practices for your Web applicationIt is important to follow security best practices for all parts of your Web application and not just the upload logic. For more information about best practices, visit the following Microsoft Web pages:
Article ID: 979124 - Last Review: Jan 26, 2010 - Revision: 1