Pure ASP Upload 3 Manual
All you need to know about Pure ASP Upload 3
Advanced: Configure Uploads for IIS Web Applications
This article describes how to configure Internet Information
Services (IIS) to allow more-secure file uploads through a Web application.
Many Web applications such as Content Management Systems require supporting
file uploads to the Web server that uses the Web application. Allowing files to
be uploaded to the Web server that uses the Web application has security
ramifications for the server, and you must understand all the implications for
allowing this. This article guides you through securing your Web application
uploads through IIS configuration. If your Web application has an automated
installer, you can also incorporate the configuration in this article into your
Note Some Web applications use databases to manage uploaded content. However, this article focuses on applications that use the file system.
How to do it
Create a separate folder for your uploaded content and change the NTFS file permissions on the upload folder
doing this, you can configure the behavior of uploaded content differently from
the rest of your Web application. Grant the upload folder Read and Write
permissions for the IIS worker process identity. For IIS 6.0 in Windows Server
2003, you can use the IIS_WPG user group for this. For IIS 7.0 and later, you
can use the IIS_IUSRS user group.
For more information about IIS_WPG, visit the following Microsoft Web page:
For more information about IIS_ISURS, visit the following Microsoft Web page:
For more information about how to help secure files with NTFS permissions, visit the following Microsoft Web page:
Note: In some cases, such as when impersonation is used, you would need to give Write access for the authenticated user context as well.
Disallow Script Permissions on the upload folder
Uploaded content for most Web applications are static content, such as images and documents. Uploaded content is not meant to be content that can be run, such as scripts or executable files. Therefore, it is important not to grant Script Permissions on this folder. Otherwise, users who can upload content can execute scripts in the context of your worker process identity on the server. If your Web application has logic to restrict uploads by file name extensions, you should use this restriction as a secondary measure. You should still make sure that your application's upload directory has script permissions disabled.
To disable script permissions in IIS Manager User Interface (inetmgr) in IIS 5.x and 6.0, follow these steps:
- Click Start, and then click Run.
- Type inetmgr in the Open box, and then click OK.
- In the tree view in the navigation pane, select the path of the upload directory of your Web application.
- Right-click this path, and then click Properties.
- Click the Directory tab, and then select None in the Execute Permissions list.
For more information about how to how to set IIS permissions for specific objects, click the following article number to view the article in the Microsoft Knowledge Base:
324068 How to set IIS permissions for specific objects
Alternatively, you can disable script permissions by using metabase configuration in IIS 6.0 by setting AccessFlags property's AccessScript flag to False at the upload directory level. For more information and for sample scripts that can be changed for this use, visit the following Microsoft Web page:
disable script permissions in configuration for IIS 7.0 and later versions, you
have to set the accessPolicy flag on the handlers section not to
have the Script value.
For more information about how to do this in IIS 7.0 and later versions, visit the following Microsoft Web page:
Note Make sure
that you read the Script value for the access flags.
For more information about how to set permissions, visit the following Microsoft Web page:
The Web application should restrict uploads to authenticated and authorized users only
This gives the server administrator the ability to audit uploads through the Web application. In the case a user is trying malicious activity, it gives the server administrator an easy mechanism to keep the application functional while blocking out users who are trying malicious activity. When users can upload scripts and execute them through the Web application, authentication should be required and the IIS application pool identity hosting the Web application should not be an Administrative account.
Lubov has been with DMXzone for 8 years now, contributing to the Content and Sales departments. She is bringing high quality content in the form of daily blog updates, reviews, tutorials, news, newsletters,update emails and extensions' manuals. If you have a product that needs publicity or any other questions about the entire DMXzone community, she is the one you can contact.