Introduction

As part of our ongoing work constantly to improve and increase security on the Vuture platform, we have introduced additional checks on file uploads to ensure that any files are excluded if they contain potentially malicious functionality. As an example, a text file (including CSV files) containing the text "win.com" could possibly be malicious and the upload will therefore fail.

To ensure that your legitimate uploads are not disrupted, we can adjust the sensitivity of this check directly on your platform by employing a config change.

 

Setup

To use the config, ask Support or your Customer Success Manager to navigate to Admin.SecurityOptions, where there are two individual configs that control how we detect possibly malicious behaviour in uploaded files:

The “Global search terms” setting will detect disallowed text throughout the entire document, regardless of its position. The term "WIN.COM" should be removed from the comma separated list in this config.

The “Code block search terms” setting will detect disallowed text inside ASP/ASPX code blocks.
This is due to the prevalence of “Webshell” scripts that could allow a malicious actor to run arbitrary code on the server, simply by uploading a specially crafted document. The term "WIN.COM" (without the quotes) should be added to the comma separated list in this config.

Once these two configs have been updated and saved the MVC app pool will need to be recycled. The infrastructure team can help with this.

Note: We have endeavoured to ensure that this will be as transparent as possible to you, but it is possible that false positives will be recorded and the uploaded file rejected.

Our team will be alerted whenever a possibly malicious file has been uploaded, whereupon your CSM will contact you to discuss the issue.