Non-Storable Content

Non-Storable Content is a common vulnerability that affects many web applications. This vulnerability arises when the server is unable to store certain types of content, allowing an attacker to upload malicious files or execute arbitrary code. This vulnerability can be exploited to execute various types of attacks, such as Cross-Site Scripting (XSS), Remote Code Execution (RCE), and File Inclusion attacks. In this guide, we will go through the steps to fix the Non-Storable Content vulnerability in a web application.

‍

Step 1: Identify the Affected Code

The first step in fixing the Non-Storable Content vulnerability is to identify the code that is causing the problem. To do this, you need to review the code that handles file uploads or input fields. Look for areas where the application accepts user input or uploads files, and ensure that the code is properly validating and filtering the content.

‍

Step 2: Filter Input Data

Once you have identified the problematic code, the next step is to filter the input data to ensure that it does not contain any malicious content. One way to do this is to use a whitelist approach, where you only allow specific types of data to be uploaded. For example, if you are only expecting image files, you can limit the upload to files with a .jpg or .png extension.

Another approach is to use a blacklist, where you block specific types of content that are known to be malicious. For example, you could block all files with a .php extension since they are commonly used for remote code execution.

‍

Step 3: Use File Type Validation

In addition to filtering input data, it is also important to validate the file type to ensure that the uploaded file is of the expected format. One way to do this is to check the file header, which contains metadata about the file. For example, if you are expecting an image file, you can check the file header to ensure that it is a valid image format, such as JPEG or PNG.

‍

Step 4: Use a Content Delivery Network (CDN)

A Content Delivery Network (CDN) is a network of servers that deliver content to users based on their location. Using a CDN can help mitigate the risk of Non-Storable Content vulnerability by offloading the storage of content to the CDN provider. This means that even if an attacker is able to upload malicious content, it will not be stored on the application server, reducing the risk of an attack.

‍

Step 5: Set Proper Permissions

Setting proper permissions is critical in preventing Non-Storable Content vulnerability. The application server should have strict permissions set for file uploads, ensuring that only authorized users can access and modify uploaded files. For example, you can limit access to uploaded files by setting the file permissions to read-only for all users except for the user account that is used by the web server.

‍

Step 6: Use a Content Security Policy (CSP)

A Content Security Policy (CSP) is a security feature that allows web developers to control the sources of content that are allowed to be loaded by their web applications. By using a CSP, you can prevent malicious content from being loaded into your application. For example, you can specify that only certain domains are allowed to load content into your application.

‍

Step 7: Use HTTPS Encryption

Using HTTPS encryption ensures that all data sent between the application server and the client browser is encrypted, reducing the risk of data interception and manipulation. It is important to note that HTTPS does not prevent Non-Storable Content vulnerability but it is an essential security measure to prevent other types of attacks.

‍

Step 8: Regular Security Scanning

Even after implementing all the above security measures, it is essential to regularly scan the application for vulnerabilities. Regular scanning helps identify any new or existing Non-Storable Content vulnerability and allows you to fix them before an attacker can exploit them. Use an external vulnerability scanner to regularly scan your application for vulnerabilities and ensure that all identified vulnerabilities are addressed promptly.

‍

Step 9: User Education

It is important to educate users of your application on safe usage and security best practices. Educate them on the importance of safe password management, not clicking on suspicious links or downloading files from untrusted sources. This can help prevent social engineering attacks that may result in Non-Storable Content vulnerability.

‍

Step 10: Keep Your Software Up-to-date

Software updates often contain security patches and bug fixes that address known vulnerabilities. Ensure that your application and all associated software components are kept up-to-date with the latest versions to minimize the risk of Non-Storable Content vulnerability.

Examples of How to Fix Non-Storable Content Vulnerability

Example 1: Whitelist Filtering

Suppose you have a web application that allows users to upload images for their profile. To prevent Non-Storable Content vulnerability, you can whitelist the accepted image formats using the following code:

$allowed_types = array('jpg', 'jpeg', 'png', 'gif'); $extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); if (in_array($extension, $allowed_types)) { // accept the file } else { // reject the file }

This code only accepts files with the extensions listed in the $allowed_types array.

Example 2: File Type Validation

Suppose you have a web application that allows users to upload PDF files. To prevent Non-Storable Content vulnerability, you can validate the uploaded file to ensure that it is a valid PDF file using the following code:

if (mime_content_type($file_path) !== 'application/pdf') { // reject the file }

This code checks the MIME type of the uploaded file to ensure that it is a PDF file.

Example 3: Content Security Policy (CSP)

Suppose you have a web application that allows users to upload images for their profile. To prevent Non-Storable Content vulnerability, you can use a Content Security Policy (CSP) to limit the domains that are allowed to load content into your application using the following code:

Content-Security-Policy: default-src 'self'; img-src *.example.com

This code specifies that only the domain example.com is allowed to load images into the application.

‍

Conclusion

Non-Storable Content vulnerability is a serious threat to web applications, and it is important to take proactive measures to prevent it. By following the steps outlined in this guide, you can effectively address Non-Storable Content vulnerability in your web application. Remember to regularly scan your application for vulnerabilities, keep your software up-to-date, and educate your users on safe usage and security best practices.

‍