Avatar Script Insertion Vulnerability (Security)

[dcabbar]

Hi All,

Looking at [secunia.com...] , it seems possible to embed javascript in images in a special way.

So, if a user provides an avatar or an image url like this pointing to an external site, they will be able to hack accounts.

Do you know how this can be avoided? And/or, how sites like vbulletin/phpbb/smf type of applications protect users from this?

Thanks.

[jatar_k]

>> Do you know how this can be avoided?

don't allow avatars

[whoisgregg]

It should also be possible to avoid the problem by rebuilding uploaded avatars via processing through the image functions [php.net]. Don't trust that an uploaded file is what they say it is.

For example, if they upload a .gif file (rather than just moving the uploaded gif to your public web folder) you would use imagecreatefromgif [php.net] then imagegif [php.net] to create the file that you end up putting in your public web folder.