Restricting file uploads in Adobe Experience Manager Assets
Unrestricted file uploads in AEM Assets can introduce security risks, such as the potential for malicious files to be stored and distributed, overloading the system, or enabling attacks on backend systems. To mitigate these risks, it is important to restrict uploads to only business-approved file types and validate the content type of uploaded files.
Description description
Environment
- Adobe Experience Manager Assets (all supported versions, including AEM as a Cloud Service)
Symptoms
- Users are able to upload files with any extension, including unsupported or potentially dangerous types (e.g., .exe).
- There are no restrictions or validation on the file type during upload.
Cause
By default, AEM Assets does not restrict file types during upload. This default behavior can expose the system to security vulnerabilities if not properly configured.
Resolution resolution
To fix the issue where users can upload unrestricted or potentially dangerous file types, follow these steps:
-
Log in to AEM with administrator privileges.
-
Navigate to Tools
>Assets>Assets Configurations. -
Click Upload Restrictions.
-
Click Add to define the allowed MIME types. For example:
-
image/jpeg
-
image/png
-
application/pdf
-
video/mp4
-
-
Add all business-approved MIME types as needed. You can add multiple entries.
-
Click Save to apply the configuration.
-
Test the upload functionality by attempting to upload a file with a disallowed extension (such as .exe). The upload should now be blocked.
-
(Optional) For enhanced security, consider integrating an external malware scanning solution to scan uploaded files before they are accepted into the repository. Refer to general secure file upload guidance, such as the OWASP Unrestricted File Upload documentation, for best practices.
For more details, see the official documentation: