Expand my Community achievements bar.

Don’t miss the AEM Skill Exchange in SF on Nov 14—hear from industry leaders, learn best practices, and enhance your AEM strategy with practical tips.
SOLVED

Issues that might arise due to having content disposition: inline on images

Avatar

Level 2

I am trying to display images (png, jpeg, gif, svg) directly on browser instead of letting the users downloading it. I've read from so many places that having content disposition header as inline might cause some security issues, and it is better to have it as attachment. Can anyone provide me a scenario where this might be a problem?

Topics

Topics help categorize Community content and increase your ability to discover relevant content.

6.5
1 Accepted Solution

Avatar

Correct answer by
Level 4

Hi @aemAmateur ,

 

yes, the OSGi config "org.apache.sling.security.impl.ContentDispositionFilter" provides the way to disable it but it could lead to security issues and that's why it is enabled by default in the product.

 

Here are a few security issues can cause: 

 

1. SVG images are vulnerable to XSS  attacks

https://research.securitum.com/do-you-allow-to-load-svg-files-you-have-xss/

 

2. if a user with access (or attacker) was to upload an HTML or JS file into the DAM which could execute first party in the domain, they could circumvent JS browser protections like ORIGIN headers.

 

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/apache-sling-content-dispo...

 

3. Also, check XSS Attack 4: Capture the keystrokes by injecting a keylogger

https://pentest-tools.com/blog/xss-attacks-practical-scenarios/

 

So, explore all the options in the above OSGI config like "Content Disposition Paths" & "Excluded Resource Paths" before disabling it for all files.

 

Hope it will help you.

 

Thanks

View solution in original post

2 Replies

Avatar

Correct answer by
Level 4

Hi @aemAmateur ,

 

yes, the OSGi config "org.apache.sling.security.impl.ContentDispositionFilter" provides the way to disable it but it could lead to security issues and that's why it is enabled by default in the product.

 

Here are a few security issues can cause: 

 

1. SVG images are vulnerable to XSS  attacks

https://research.securitum.com/do-you-allow-to-load-svg-files-you-have-xss/

 

2. if a user with access (or attacker) was to upload an HTML or JS file into the DAM which could execute first party in the domain, they could circumvent JS browser protections like ORIGIN headers.

 

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/apache-sling-content-dispo...

 

3. Also, check XSS Attack 4: Capture the keystrokes by injecting a keylogger

https://pentest-tools.com/blog/xss-attacks-practical-scenarios/

 

So, explore all the options in the above OSGI config like "Content Disposition Paths" & "Excluded Resource Paths" before disabling it for all files.

 

Hope it will help you.

 

Thanks

Avatar

Level 2
Sanket, thanks for the reply. I specifically want to display some pictures that are stored under 'content/dam/*: images/png'. can i add a 'Content-Security-Policy': 'script-src none' header to those urls to stop script execution?