Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
BedrockMission!

Learn more

View all

Sign in to view all badges

SOLVED

Issues that might arise due to having content disposition: inline on images

aemAmateur
Level 2
Level 2

I am trying to display images (png, jpeg, gif, svg) directly on browser instead of letting the users downloading it. I've read from so many places that having content disposition header as inline might cause some security issues, and it is better to have it as attachment. Can anyone provide me a scenario where this might be a problem?

AEM 6.5 security check
1 Accepted Solution
Sanket_Kumbharkhane
Correct answer by
Level 4
Level 4

Hi @aemAmateur ,

 

yes, the OSGi config "org.apache.sling.security.impl.ContentDispositionFilter" provides the way to disable it but it could lead to security issues and that's why it is enabled by default in the product.

 

Here are a few security issues can cause: 

 

1. SVG images are vulnerable to XSS  attacks

https://research.securitum.com/do-you-allow-to-load-svg-files-you-have-xss/

 

2. if a user with access (or attacker) was to upload an HTML or JS file into the DAM which could execute first party in the domain, they could circumvent JS browser protections like ORIGIN headers.

 

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/apache-sling-content-dispo...

 

3. Also, check XSS Attack 4: Capture the keystrokes by injecting a keylogger

https://pentest-tools.com/blog/xss-attacks-practical-scenarios/

 

So, explore all the options in the above OSGI config like "Content Disposition Paths" & "Excluded Resource Paths" before disabling it for all files.

 

Hope it will help you.

 

Thanks

View solution in original post

2 Replies
Sanket_Kumbharkhane
Correct answer by
Level 4
Level 4

Hi @aemAmateur ,

 

yes, the OSGi config "org.apache.sling.security.impl.ContentDispositionFilter" provides the way to disable it but it could lead to security issues and that's why it is enabled by default in the product.

 

Here are a few security issues can cause: 

 

1. SVG images are vulnerable to XSS  attacks

https://research.securitum.com/do-you-allow-to-load-svg-files-you-have-xss/

 

2. if a user with access (or attacker) was to upload an HTML or JS file into the DAM which could execute first party in the domain, they could circumvent JS browser protections like ORIGIN headers.

 

https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/apache-sling-content-dispo...

 

3. Also, check XSS Attack 4: Capture the keystrokes by injecting a keylogger

https://pentest-tools.com/blog/xss-attacks-practical-scenarios/

 

So, explore all the options in the above OSGI config like "Content Disposition Paths" & "Excluded Resource Paths" before disabling it for all files.

 

Hope it will help you.

 

Thanks

View solution in original post

aemAmateur
Level 2
Level 2
Sanket, thanks for the reply. I specifically want to display some pictures that are stored under 'content/dam/*: images/png'. can i add a 'Content-Security-Policy': 'script-src none' header to those urls to stop script execution?