{"id":"https://openalex.org/W4407784034","doi":"https://doi.org/10.1109/tifs.2025.3544082","title":"Understanding the Security Risks of Websites Using Cloud Storage for Direct User File Uploads","display_name":"Understanding the Security Risks of Websites Using Cloud Storage for Direct User File Uploads","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4407784034","doi":"https://doi.org/10.1109/tifs.2025.3544082"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3544082","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3544082","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/tifs.2025.3544082","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020468399","display_name":"Yuanchao Chen","orcid":"https://orcid.org/0000-0002-1532-6658"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]},{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuanchao Chen","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China","College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-1532-6658","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100331391","display_name":"Yuwei Li","orcid":"https://orcid.org/0000-0002-8878-510X"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuwei Li","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-8878-510X","affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089358541","display_name":"Yuliang Lu","orcid":"https://orcid.org/0000-0002-8502-9907"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuliang Lu","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-8502-9907","affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006569051","display_name":"Zulie Pan","orcid":"https://orcid.org/0000-0001-5775-5824"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zulie Pan","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0001-5775-5824","affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yuan Chen","orcid":"https://orcid.org/0000-0002-3945-2034"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]},{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Chen","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China","College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-3945-2034","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Shouling Ji","orcid":"https://orcid.org/0000-0003-4268-372X"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shouling Ji","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-4268-372X","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yu Chen","orcid":"https://orcid.org/0000-0003-0601-4879"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]},{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Chen","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, China","College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0003-0601-4879","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I168879160"]},{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100657407","display_name":"Yang Li","orcid":"https://orcid.org/0009-0005-9585-3472"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Li","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":"https://orcid.org/0009-0005-9585-3472","affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"last","author":{"id":null,"display_name":"Yi Shen","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yi Shen","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, China","institution_ids":["https://openalex.org/I170215575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":22.198,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":{"value":0.99247877,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"20","issue":null,"first_page":"2677","last_page":"2692"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.9627000093460083,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.9627000093460083,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13243","display_name":"Innovation in Digital Healthcare Systems","score":0.9211000204086304,"subfield":{"id":"https://openalex.org/subfields/3605","display_name":"Health Information Management"},"field":{"id":"https://openalex.org/fields/36","display_name":"Health Professions"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8097963333129883},{"id":"https://openalex.org/keywords/upload","display_name":"Upload","score":0.7191382646560669},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.6447259187698364},{"id":"https://openalex.org/keywords/cloud-storage","display_name":"Cloud storage","score":0.6417219042778015},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5363709926605225},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.45468828082084656},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.41275089979171753},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.3872023820877075},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.34235185384750366},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.3243185877799988},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.19604569673538208}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8097963333129883},{"id":"https://openalex.org/C71901391","wikidata":"https://www.wikidata.org/wiki/Q7126699","display_name":"Upload","level":2,"score":0.7191382646560669},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6447259187698364},{"id":"https://openalex.org/C2777059624","wikidata":"https://www.wikidata.org/wiki/Q914359","display_name":"Cloud storage","level":3,"score":0.6417219042778015},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5363709926605225},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.45468828082084656},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.41275089979171753},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3872023820877075},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.34235185384750366},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.3243185877799988},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.19604569673538208}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3544082","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3544082","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/tifs.2025.3544082","is_oa":true,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3544082","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G8211781582","display_name":null,"funder_award_id":"62202484","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W1576191218","https://openalex.org/W1582010081","https://openalex.org/W2049214202","https://openalex.org/W2083570493","https://openalex.org/W2088673953","https://openalex.org/W2119028650","https://openalex.org/W2153721248","https://openalex.org/W2510134782","https://openalex.org/W2535549398","https://openalex.org/W2563363534","https://openalex.org/W2570716833","https://openalex.org/W2578124543","https://openalex.org/W2616646314","https://openalex.org/W2734469389","https://openalex.org/W2746739457","https://openalex.org/W2752602409","https://openalex.org/W2762453390","https://openalex.org/W2791815824","https://openalex.org/W2891007563","https://openalex.org/W2925534222","https://openalex.org/W2929275958","https://openalex.org/W2945355808","https://openalex.org/W2947593054","https://openalex.org/W2986807064","https://openalex.org/W3009004523","https://openalex.org/W3034053419","https://openalex.org/W3043071284","https://openalex.org/W3048689837","https://openalex.org/W3089142318","https://openalex.org/W3205078333","https://openalex.org/W4253731935","https://openalex.org/W4288057795","https://openalex.org/W4291518140","https://openalex.org/W4320008875","https://openalex.org/W4384948751","https://openalex.org/W4388857684","https://openalex.org/W4388878391","https://openalex.org/W6608723218"],"related_works":["https://openalex.org/W2931996793","https://openalex.org/W4205234238","https://openalex.org/W2946255556","https://openalex.org/W3148880067","https://openalex.org/W2788934790","https://openalex.org/W3167767780","https://openalex.org/W1988660452","https://openalex.org/W3043682580","https://openalex.org/W2941559775","https://openalex.org/W1996899447"],"abstract_inverted_index":{"With":[0,79],"the":[1,37,71,95,111,115,139,153,167,187],"rising":[2],"demand":[3],"for":[4,12,194],"website":[5],"data":[6],"storage,":[7],"leveraging":[8],"cloud":[9,38,56,107,191],"storage":[10,16,39,57,108,192],"services":[11,193],"vast":[13],"user":[14,129],"file":[15,23],"has":[17,26],"become":[18],"prevalent.":[19],"Nowadays,":[20],"a":[21,120],"new":[22,42,63,85,146],"upload":[24,33],"scenario":[25,43],"been":[27],"introduced,":[28],"allowing":[29],"web":[30,51,53],"users":[31],"to":[32,36,152],"files":[34],"directly":[35],"service.":[40],"This":[41],"offers":[44,182],"convenience":[45],"but":[46],"involves":[47],"more":[48],"roles":[49],"(i.e.,":[50],"users,":[52],"servers,":[54],"and":[55,59,89,148,163,173,196],"services)":[58],"their":[60],"interactions,":[61],"bringing":[62],"security":[64,74,188],"threats.":[65],"In":[66,178],"this":[67,77],"paper,":[68],"we":[69,82,118,143],"perform":[70,119],"first":[72],"systematic":[73],"study":[75],"in":[76,185],"scenario.":[78],"in-depth":[80],"analysis,":[81],"identify":[83],"six":[84,140],"types":[86],"of":[87,114,123,138,170,190],"vulnerabilities":[88,147,172],"conduct":[90],"large-scale":[91],"real-world":[92],"measurements":[93],"on":[94],"top":[96],"500":[97],"Alexa":[98],"Rank":[99],"websites.":[100,154],"Among":[101],"these":[102,171],"websites,":[103],"182":[104],"(36.4%)":[105],"use":[106,113],"services,":[109],"illustrating":[110],"widespread":[112],"cloud.":[116],"Then,":[117],"detailed":[121],"analysis":[122],"28":[124],"popular":[125,156],"websites":[126,157,195],"that":[127],"allow":[128],"upload.":[130],"Surprisingly,":[131],"they":[132],"all":[133],"have":[134],"at":[135],"least":[136],"one":[137],"vulnerabilities.":[141],"Totally,":[142],"discover":[144],"79":[145],"responsibly":[149],"report":[150],"them":[151],"Many":[155],"respond":[158],"positively,":[159],"including":[160],"Google,":[161],"Reddit,":[162],"CSDN.":[164],"We":[165],"discuss":[166],"root":[168],"causes":[169],"propose":[174],"possible":[175],"mitigation":[176],"methods.":[177],"summary,":[179],"our":[180],"work":[181],"significant":[183],"value":[184],"understanding":[186],"risks":[189],"facilitating":[197],"future":[198],"research.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":5}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}