How to configure uploads for IIS Web applications

This article describes how to configure Internet Information Services (IIS) to allow more-secure file uploads through a Web application. Many Web applications such as Content Management Systems require supporting file uploads to the Web server that uses the Web application. Allowing files to be uploaded to the Web server that uses the Web application has security ramifications for the server, and you must understand all the implications for allowing this. This article guides you through securing your Web application uploads through IIS configuration. If your Web application has an automated installer, you can also incorporate the configuration in this article into your installer.

Note Some Web applications use databases to manage uploaded content. However, this article focuses on applications that use the file system.

Create a separate folder for your uploaded content and change the NTFS file permissions on the upload folder

By doing this, you can configure the behavior of uploaded content differently from the rest of your Web application. Grant the upload folder Read and Write permissions for the IIS worker process identity. For IIS 6.0 in Windows Server 2003, you can use the IIS_WPG user group for this. For IIS 7.0 and later, you can use the IIS_IUSRS user group.

For more information about IIS_WPG, visit the following Microsoft Web page: For more information about IIS_ISURS, visit the following Microsoft Web page: For more information about how to help secure files with NTFS permissions, visit the following Microsoft Web page: Note In some cases, such as when impersonation is used, you would need to give Write access for the authenticated user context as well.

Disallow Script Permissions on the upload folder

Uploaded content for most Web applications are static content, such as images and documents. Uploaded content is not meant to be content that can be run, such as scripts or executable files. Therefore, it is important not to grant Script Permissions on this folder. Otherwise, users who can upload content can execute scripts in the context of your worker process identity on the server. If your Web application has logic to restrict uploads by file name extensions, you should use this restriction as a secondary measure. You should still make sure that your application�s upload directory has script permissions disabled.

To disable script permissions in IIS Manager User Interface (inetmgr) in IIS 5.x and 6.0, follow these steps:

1. Click Start, and then click Run.
2. Type inetmgr in the Open box, and then click OK.
3. In the tree view in the navigation pane, select the path of the upload directory of your Web application.
4. Right-click this path, and then click Properties.
5. Click the Directory tab, and then select None in the Execute Permissions list.

For more information about how to how to set IIS permissions for specific objects, click the following article number to view the article in the Microsoft Knowledge Base: Alternatively, you can disable script permissions by using metabase configuration in IIS 6.0 by setting AccessFlags property�s AccessScript flag to False at the upload directory level. For more information and for sample scripts that can be changed for this use, visit the following Microsoft Web page: To disable script permissions in configuration for IIS 7.0 and later versions, you have to set the accessPolicy flag on the handlers section not to have the Script value.

For more information about how to do this in IIS 7.0 and later versions, visit the following Microsoft Web page: Note Make sure that you read the Script value for the access flags.

For more information about how to set permissions, visit the following Microsoft Web page:

The Web application should restrict uploads to authenticated and authorized users only

This gives the server administrator the ability to audit uploads through the Web application. In the case a user is trying malicious activity, it gives the server administrator an easy mechanism to keep the application functional while blocking out users who are trying malicious activity. When users can upload scripts and execute them through the Web application, authentication should be required and the IIS application pool identity hosting the Web application should not be an Administrative account.

For more information about how to configure application pool identities, visit the following Microsoft Web pages:

Follow security best practices for your Web application

It is important to follow security best practices for all parts of your Web application and not just the upload logic. For more information about best practices, visit the following Microsoft Web pages: