How Secure Is the Iptanus File Upload Plugin?

Iptanus File Upload lets visitors upload files from the front end of a site. It can take several files at once, collect information alongside them, send email, and display and serve the files afterwards, among much else.

Is there a risk?

Anything that accepts files from strangers deserves scrutiny. Could someone upload a dangerous file and damage the site, or get at information they should not have? Could someone use CSRF or XSS to gain access they were never granted?

We take the question seriously. The plugin is built to be secure, and its measures have been tested and sharpened in close cooperation with independent security specialists. It follows WordPress’s own recommendations, along with widely accepted practice for defence at every level.

The measures taken

• The plugin refuses suspicious file extensions — anything that might carry code the server would run, such as .php, .js or .html. The check happens on the server, before the upload begins, so unauthorised code never reaches a place it could execute from.
• Every request is verified before it is acted on. The server-side scripts check WordPress nonces and the referrer, unique IDs held in session variables, the current user’s capabilities, and that the request’s parameters exist and are valid. This is what defeats CSRF.
• Where it helps — verifying a captcha, or serving a download — the plugin also issues tokens with a very short life. Even if someone captures the request and replays it, to get past a captcha or pull a file off the site, the token has expired and the request fails.
• Every parameter reaching a server script is sanitised first. Executable code passed through a parameter is neutralised or rejected outright. This is what defeats XSS.
• No sensitive information — keys, codes, URLs, absolute file paths — is ever exposed to the browser, so there is nothing there worth stealing.
• The Dashboard file browser is hardened. Even an attacker who has already reached the Dashboard cannot use it to rename, delete or alter system files: it will not touch anything outside the site root or belonging to the system, and rename, delete and download work only on files the plugin itself uploaded.
• A captcha can be required before an upload, which keeps robots from flooding the site with junk files and filling the server’s disk.

Security is a continuous process

Defending against attack is never finished, and we keep working at it. Anything reported to us that touches security is dealt with first, and fixed quickly.

For a broader view of keeping a WordPress site secure, this guide is a good starting point.

If you have questions or would like more detail, please contact the Iptanus team.