topic Re: Prevent end-user from uploading malicious file types in Report Server

Prevent end-user from uploading malicious file types

ynt — Thu, 18 Oct 2018 01:25:20 GMT

We recently performed penetration testing and found several vulnerabilities including the issue with unrestricted file upload that pose significant risk.

Is there a configuration in Power BI Report Server to use a whitelist method to prevent end-user from uploading malicious file type like .exe, .py, etc.?

Thanks.

Re: Prevent end-user from uploading malicious file types

Jon-Heide — Mon, 22 Oct 2018 21:23:48 GMT

Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.

Re: Prevent end-user from uploading malicious file types

Jon-Heide — Mon, 22 Oct 2018 21:26:11 GMT

You can also use server permissions to disallow users from uploading content in general.

Re: Prevent end-user from uploading malicious file types

ynt — Tue, 23 Oct 2018 16:53:20 GMT

Jon-Heide wrote:
Yes, this is whitelisted under the TrustedFileFormat property, editable through SQL Management Studio when you connect to the PBIRS instance.

This setting does not prevent user from downloading/uploading malicious file types

https://docs.microsoft.com/en-us/sql/reporting-services/tools/server-properties-advanced-page-reporting-services?view=sql-server-2017

TrustedFileFormat Set all the external file formats that open within the browser under the Reporting Services portal site. External file formats not listed prompts to download the option in the browser. The default values are jpg, jpeg, jpe, wav, bmp, pdf, img, gif, json, mp4, web, png.

Re: Prevent end-user from uploading malicious file types

ynt — Tue, 23 Oct 2018 16:52:50 GMT

Jon-Heide

Jon-Heide wrote:
You can also use server permissions to disallow users from uploading content in general.

Can you please point me to this particular setting?

Re: Prevent end-user from uploading malicious file types

Jon-Heide — Tue, 23 Oct 2018 17:56:38 GMT

https://docs.microsoft.com/en-us/sql/reporting-services/security/granting-permissions-on-a-native-mode-report-server?view=sql-server-2017

Re: Prevent end-user from uploading malicious file types

ynt — Tue, 23 Oct 2018 22:07:15 GMT

Jon-Heide wrote:
https://docs.microsoft.com/en-us/sql/reporting-services/security/granting-permissions-on-a-native-mode-report-server?view=sql-server-2017

For our use case, we can't disable the upload feature. We need to be able to whitelist certain file types that can be uploaded to PBI Report Server.