Media file path based vulnerablity

Question

During a vulnerability scan, Path-Based Vulnerability has been reported in the below-mentioned links,

www.sample.com/web/abcdefgh/ijklmnop/-/document_library_display.old www.sample.com/web/abcdefgh/ijklmnop/-/document_library_display.bak www.sample.com/web/abcdefgh/ijklmnop/-/document_library_display.inc

We do not find any .old, .bak and .inc files present anywhere in the application.how to avoid accessing these extensions.

Answer 1

It's a known issue that Sitecore will serve media requests regardless of the request extension. If you want to prevent media being accessed using an incorrect extension then you need to handle this yourself.

Media Request Event

One option is to add an handler for the media:request event that will check the file extension of the request against the resolved media item, and return a 404 status code if they do not match.

using System;
using System.Linq;
using System.Net;
using Sitecore.Events;
using Sitecore.IO;
using Sitecore.Resources.Media;

namespace MySite.Custom.Media.Events
{
    public class CheckMediaExtension
    {
        public void OnMediaRequest(object sender, EventArgs args)
        {
            // Safety checks
            if (Sitecore.Context.Site.Name.Equals(Sitecore.Constants.ShellSiteName, StringComparison.InvariantCultureIgnoreCase))
                return;
            var sitecoreEventArgs = (SitecoreEventArgs) args;
            if (sitecoreEventArgs == null || !sitecoreEventArgs.Parameters.Any())
                return;
            var request = (MediaRequest) sitecoreEventArgs.Parameters[0];
            if (request == null)
                return;

            // Now we've established we have a valid request
            var mediaItem = MediaManager.GetMedia(request.MediaUri).MediaData.MediaItem;
            string requestExtension = FileUtil.GetExtension(request.InnerRequest.RequestContext.HttpContext.Request.FilePath);

            if (!string.Equals(mediaItem.Extension, requestExtension, StringComparison.InvariantCultureIgnoreCase))
            {
                var response = request.InnerRequest.RequestContext.HttpContext.Response;
                response.Clear();
                response.TrySkipIisCustomErrors = true;
                response.StatusCode = (int) HttpStatusCode.NotFound;
                response.End();
            }
        }
    }
}

And then patch this event handler in:

<sitecore>
  <events>
    <event name="media:request">
      <handler type="MySite.Custom.Media.Events.MediaRequestEvent, MySite.Custom" method="OnMediaRequest"/>
    </event>
  </events>
</sitecore>

If you go down this route then make sure you have set the Media.RequestExtension to empty, which will cause the media URLs to be generated with the correct file type extension.

<!--
  MEDIA - REQUEST EXTENSION
  The extension to use in media request URLs.
  If the value is not set, the Extension field of the individual media items 
  will be used (ie. JPG, GIF, etc.)
  Default value: "ashx"
-->
<setting name="Media.RequestExtension" set:value=""/>