Sewar Khalifeh
An experienced Secure by Design Consultant with more than 3 years of experience in the banking and telecommunications industries, I specialize in integrating security into organizational practices. My expertise includes conducting security assessments, performing threat modeling, and managing risk mitigation in cloud and hybrid environments. In addition to my technical skills, I excel in project management, leading cybersecurity initiatives that promote a strong security culture. My ability to combine technical knowledge with leadership has successfully enhanced security acceptance and integration within organizations.
Session
Unrestricted file uploads pose a significant threat to application security, allowing attackers to exploit various vulnerabilities and gain unauthorised access to systems and data. And there are some potential risks associated with unrestricted file uploads, such as: Triggering vulnerabilities in libraries/applications, abusing real-time security tools, executing malicious code and unauthorised access to sensitive files. In addition to the standard security best practices for file uploads, such as restricting file size, types, and extensions; experts recommends security controls to further enhance protection and validate files. These technologies include Content Disarm and Reconstruction (CDR), multi-AV scanning, sandboxing, and single-AV scanning. The aim of this presentation is to provide a detailed walkthrough of the risks and attacks associated with unrestricted file upload vulnerabilities, review the protective technologies available, outline proper mitigation strategies, and give practical examples on how to secure your environment against malicious uploads.