Reimbursement Portal Parser Under Active Probing
BrightDesk is a 300-person SaaS company. Its internal HR portal, built in 2019, lets employees upload reimbursement PDFs. The app runs in one container on a shared Kubernetes node, uses a third-party PDF parsing library pinned at version 2.3.0, and passes uploaded files to ImageMagick for thumbnail generation. Last Tuesday the WAF logged 214 requests with '../' and encoded null bytes; one request returned HTTP 200 with a 1.2 MB response. The vendor released a patch for the PDF library yesterday, but the platform team says redeploying requires a 72-hour change-approval window and a database migration. The security team can block the route at the WAF in 30 minutes. The portal is internet-facing and has no file-type allowlist beyond the browser's accept attribute. The CISO asks for a decision before the next batch of month-end reimbursements, when 600 employees are expected to upload receipts.
1. What immediate containment step do you authorize, and what residual risk remains until the code fix ships? Explain your reasoning.
Read the worked answer
Decision: Apply the WAF rule now to block traversal and null-byte patterns on the upload route, and temporarily disable thumbnail generation for reimbursement PDFs while returning a generic processing-delayed message. Also cap upload size at 5 MB and enforce a server-side PDF-only content check.
Reasoning: The HTTP 200 with a 1.2 MB response is evidence that the parser processed a malicious payload, not proof of compromise. The code fix is the durable control, but 72 hours is too long to leave an internet-facing parser exposed when 600 uploads are imminent. WAF blocking is fast, yet encoding variants can bypass it, and the parser may be reachable through other routes. Disabling thumbnails removes the ImageMagick path, but the PDF library still parses the file. Therefore also run the parser in a low-privilege container with no network egress and alert on child processes. Residual risk remains: a parser exploit could still execute inside the sandbox, and the WAF cannot inspect malformed or encrypted content. Document the exception and require the code fix within the change window.
2. The product owner proposes changing the JavaScript MIME check instead of upgrading the parser library. Evaluate that proposal.
Read the worked answer
Client-side validation is not a security control. The browser accept attribute and a JavaScript MIME check can be bypassed by a direct POST with a crafted Content-Type or a polyglot file. The server must validate by magic bytes, enforce a strict allowlist for application/pdf, reject archives and embedded JavaScript, and re-encode images rather than trusting the original. The PDF library should be upgraded and pinned with a software bill of materials, but the code path should also run as a non-root user with a read-only filesystem and no outbound network. Add malformed-file regression tests to the CI pipeline. Until the deploy window, keep the WAF rule as a virtual patch and alert on parser child processes. The product owner's change reduces accidental uploads, not attacker uploads, so it does not justify delaying the server-side fix.