Supported File Types
What is CDR?
An increasingly popular and effective method of compromising computer security, especially as part of a targeted attack, involves sharing common document types or image files with victims. Even though the original versions of these files do not contain executable data, attackers have found ways to trigger these files to execute embedded malicious code. Popular techniques used to accomplish this include VBA macros, exploit payloads, and embedded Flash or JavaScript code. This type of attack has a high success rate because most users don’t expect common file types to contain infections. For high-risk files or scenarios, Content Disarm & Reconstruction (CDR) prevents any possibility of malicious content (including zero-day threats) from executing. High-risk files can be sanitized through several different methods:
Removing hidden exploitable objects (e.g, scripts, macros, etc.)
Converting the file format
Supported File Types (both Windows and Linux)
Source File Type | Description | Target Sanitized Types | |
|---|---|---|---|
1 | doc | Microsoft Word 97-2003 Document | doc, docx, pdf, rtf |
2 | dot | Microsoft Word 97-2003 Template | dot, dotx |
3 | xls | Microsoft Excel 97-2003 Workbook | xls, pdf, csv |
4 | xlt | Microsoft Excel 97-2003 Template | xlt, |
5 | ppt | Microsoft PowerPoint 97-2003 Presentation | ppt, pdf |
6 | pot | Microsoft PowerPoint 97-2003 Template | pot, |
7 | rtf | Microsoft Rich Text Format | rtf, pdf* |
8 | docx | Microsoft Word Document | docx, txt, html, pdf, |
9 | docm | Microsoft Word Macro-Enabled Document | docm, |
10 | dotx | Microsoft Word Template | dotx |
11 | dotm | Microsoft Word Macro-Enabled Template | dotm , dotx |
12 | xlsx | Microsoft Excel Workbook | xlsx, csv, html, |
13 | xlsm | Microsoft Excel Macro-Enabled Workbook | xlsm , |
14 | xlsb | Microsoft Excel Binary Workbook | xlsb |
15 | xltx | Microsoft Excel Template | xltx, |
16 | xltm | Microsoft Excel Macro-Enabled Template | xltm, |
17 | xlam | Microsoft Excel Add-in | xlam |
18 | csv | Comma-separated values | csv |
19 | tsv | Tab-separated values | tsv |
20 | pptx | Microsoft PowerPoint Presentation | pptx, |
21 | potx | Microsoft PowerPoint Template | potx, |
22 | pptm | Microsoft PowerPoint Macro-Enabled Presentation | pptm , |
23 | potm | Microsoft PowerPoint Macro-Enabled Template | potm, |
24 | pps | Microsoft PowerPoint 97-2003 Show | pps, |
25 | ppsm | Microsoft PowerPoint Macro-Enabled Show | ppsm, |
26 | ppsx | Microsoft PowerPoint Show | ppsx, bmp |
27 | ppam | Microsoft Powerpoint add-on | ppam |
28 | sldx | Microsoft Powerpoint Slide 2007+ | sldx |
29 | sldm | Microsoft Office PowerPoint 2007 Slide - Macro Enabled | sldm |
30 | vsdx | Microsoft Visio Drawing | vsdx, |
31 | vssx | Microsoft Visio Stencil | vssx, |
32 | vstx | Microsoft Visio Template | vstx, |
33 | vsdm | Microsoft Visio Macro-Enabled Drawing | vsdm, |
34 | vssm | Microsoft Visio Macro-Enabled Stencil | vssm, |
35 | vstm | Microsoft Visio Macro-Enabled Template | vstm, |
36 | vsx | Microsoft Visio XML Stencil | vsx, |
37 | vtx | Microsoft Visio XML Template | vtx, |
38 | vdx | Microsoft Visio XML Drawing | vdx, |
39 | one | Microsoft OneNote | one |
40 | odt | OpenDocument Text | odt |
41 | ods | OpenDocument Spreadsheet | ods |
42 | ott | OpenDocument Document Template | ott |
43 | ots | OpenDocument Spreadsheet Template | ots |
44 | odp | OpenDocument Presentation | odp |
45 | otp | OpenDocument Presentation Template | otp |
46 | htm/html | Hypertext Markup Language | html, |
47 | mht | MIME HTML | pdf, |
48 | hta | HTML Application | hta |
49 | Adobe Portable Document Format | pdf, | |
50 | ai | Adobe Illustrator | ai |
51 | ait | Adobe Illustrator Template | ait |
52 | hwp | Hangul Word Processor | hwp |
53 | hwt | Hangul Word Template | hwt |
54 | hwpx | Hangul Word Processor | hwpx |
55 | cell | Hancom Cell | cell |
56 | show | Hancom Show | show |
57 | jtd | Ichitaro Document | jtd |
58 | jtdc | Ichitaro Compressed Document | jtdc |
59 | jhd | Justsystem Hanako | jhd |
60 | xml | Extensible Markup Language | xml |
61 | xml-doc | Microsoft Word 2003 XML Document | |
62 | xml-docx | Microsoft Word XML Document | |
63 | xml-xls | Microsoft XML Spreadsheet 2003 | |
64 | twbx | Tableau packaged workbook | twbx |
65 | twb | Tableau workbook | twb |
66 | tds | Tableau Datasource | tds |
67 | rdf | Resource Description Framwork | rdf |
68 | vcs | vCalendar | vcs |
69 | ics | iCalendar | ics |
70 | lnk | Windows Shortcut | lnk |
71 | jpg | JPEG Image | jpg, bmp, png, tiff, svg, gif, ps, eps, pdf* |
72 | jpx | JPEG 2000 | jpx |
73 | bmp | Windows Bitmap Image | bmp, jpg, png, tiff, svg, gif, ps, eps, pdf* |
74 | png | Portable Network Graphics | png, jpg, bmp, tiff, svg, gif, ps, eps, pdf* |
75 | apng | Animated PNG | apng, png |
76 | tiff | Tagged Image File Format | tiff, jpg, bmp, png, svg, gif, ps, eps |
77 | tiff64 | Big Tiff | tiff64, jpg, png, gif, bmp |
78 | nef | Nikon Raw Image | nef, jpg, bmp, png, svg, gif |
79 | svg | Scalable Vector Graphics | svg, |
80 | gif | Graphics Interchange Format | gif, jpg, bmp, png, tiff, svg, ps, eps, pdf* |
81 | wmf | Windows Metafile | wmf, |
82 | emf | Windows Enhanced Metafile | emf |
83 | ico | Icon | ico |
84 | cur | Cursor | cur |
85 | webp | Google Image File Format for Web | webp |
86 | wdp | HD Photo | wdp |
87 | dwg | AutoCAD | dwg |
88 | dwt | AutoCAD Drawing Template | dwt |
89 | dws | AutoCAD Drawing Standards | dws |
90 | sfc | SXF Feature Comment | sfc |
91 | p21 | STEP Data Model | p21 |
92 | jww | JW CAD | jww |
93 | jwc | JW CAD | jwc |
94 | bfo | V-nas BFO | bfo |
95 | dxf | AutoCAD DXF | dxf, pdf, |
96 | dwf | Design Web Format | dwf, pdf, |
97 | 3ds | 3D Studio | 3ds, |
98 | dae | Digital Asset Exchange | dae, |
99 | u3d | Universal 3D | u3d, |
100 | drc | Google Draco | drc, |
101 | rvm | AVEVA Plant Design Management System Model | rvm, |
102 | dcm | Digital Imaging and Communications in Medicine | dcm |
103 | shp | Shapefile | shp |
104 | shx | Shapefile | shx |
105 | dbf | Shapefile | dbf |
106 | heic | High Efficiency Image File Format | heic, jpg, pdf |
107 | wmv | Windows Media Video | wmv |
108 | wma | Windows Media Audio | wma |
109 | mpeg | Moving Picture Experts Group | mpeg |
110 | wav | Waveform Audio | wav |
111 | mp3 | MPEG-1 Audio Layer-3 | mp3 |
112 | mp4 | MPEG-4 Part 14 | mp4 |
113 | mov | QuickTime video format | mov |
114 | avi | Audio Video Interleave | avi |
115 | webm | Video file format | webm |
116 | flv | Flash Video | flv |
117 | bwf | Broadcast wave format | bwf |
118 | w64 | Sony wave64 autdio format | w64 |
119 | rf64 | BWF-compatible multichannel audio file format | rf64 |
120 | m4a | MPEG-4 Audio | m4a |
121 | mts | MPEG-2 Tranmission | m2s |
122 | ogg | Ogg Vorbis Compressed Audio | ogg |
123 | aiff | Audio Interchange File Forma | aiff |
124 | aac | Advanced Audio Coding | aac |
125 | opus | Ogg Opus | opus |
126 | mxf | Material Exchange Format | mxf |
127 | vtxt | VTXT | vtxt |
128 | eml | Electronic mail | eml |
129 | msg | Microsoft Outlook Message | msg |
130 | oft | Microsoft Outlook Template | oft |
131 | pst | Outlook Personal Folder | pst |
132 | txt | Text | txt, pdf |
133 | json | JSON | json |
134 | xdw | DocuWork Image | xdw* |
135 | xbd | DocuWork Binder | xbd* |
136 | xct | DocuWork Container | xct* |
137 | crl | Certificate Revocation List | crl |
138 | spf | StorageCraft ShadowProtect | spf |
139 | prn | printing | prn |
140 | utib | UTIB | utib |
141 | har | HTML Archive | har |
142 | story | Storyist Document | story |
143 | 7z | 7-zip Archive | 7z, zip, gz, xz, tar |
144 | gz/gzip | GNU Zipped Archive | gz, 7z, zip, xz, tar |
145 | rar | WinRAR Archive | rar, zip, 7z, gz, xz, tar |
146 | xz | XZ Archive | xz, zip, 7z, gz, tar |
147 | zip | ZIP Archive | zip, 7z, gz, xz, tar |
148 | alz | ALZip | zip, 7z, gz, xz, tar |
149 | tar | Tape Archive | tar, zip, 7z, gz, xz |
150 | bz2 | BZ2 Archive | zip, 7z, gz, xz, tar |
151 | lzma | LZMA Archive | zip, 7z, gz, xz, tar |
152 | lzh | LZH Archive | zip, 7z, gz, xz, tar |
153 | arj | ARJ Archive | zip, 7z, gz, xz, tar |
154 | cab | Cabinet Archive | cab, zip, 7z, gz, xz, tar |
155 | wsp | Windows Sharepoint | zip, 7z, gz, xz, tar |
156 | ace | WinAce archive format | zip, 7z, gz, xz, tar |
157 | tse | TIP Test Selection Engine | tse, zip, 7z, gz, xz, tar |
158 | tsez | TIP Test Selection Engine | tsez, zip, 7z, gz, xz, tar |
159 | tsec | TIP Test Selection Engine | tsec, zip, 7z, gz, xz, tar |
160 | egg | EGG archive format | zip, 7z, gz, xz, tar |
161 | asics | Associated Signature Container | asics |
162 | asice | Associated Signature Container | asice |
163 | es3 | e-dossier | es3 |
164 | pck | System Center Configuration Manager Package Files | pck |
165 | aem | AppleSingle/AppleDouble Encoded Macintosh | aem |
166 | ribc | Research Institute on Building Cost | ribc |
(*) Only supported on Windows for now.
For the archive sanitization, please enable it in the Compression tab
Sanitization is in BETA for these file types:
AAC
MTS, FLV
VTXT
MXF
SPF
TWBX, TWB
TDS
SHP, SHX, DBF
XBD
ONE
RDF
PPAM
UTIB
HAR
XCT
BFO
STORY
ASICS, ASICE
ES3, PCK, AEM
PRN
XLAM
DWF
AIT
RIBC
XML sanitization is specific to XML vulnerability. It does not eliminate other threat such as Microsoft Office XML formats.
HTML/TXT sanitization is designed for Email Security purposes, should not use for sanitizing normal HTML traffic.
HWP: there are two versions of HWP, v3.0 and v5.0. v3.0 document can be created from only legacy old Hangul Word Processor. For this reason, we do not support HWP v3 and result in "failed to sanitize". We recommend this old version file as suspicious. If you need support for v3.0, please contact support.
XDW/XBD/XCT: Customers need to install and activate DocuWorks 9 or newer on the system to use this feature
HEIC: it is enabled on-demand, please contact Customer Support or Sales team to enable it.
Single / Multiple Output File
If target contains only one file, it will be not zipped and treat as single output file. For example, If a PDF file has only one page, converts to JPG will be JPG. If a PDF file has more than one page, there will be multiple JPG files and will result in a ZIP file. The following sanitization result in potentially multiple files (single ZIP file).
PDF->HTML
PDF->IMG
DOCX→HTML, IMG
XLSX->HTML, CSV, IMG
PPTX→HTML, IMG
Notes:
Deep CDR removes active content that can drive a malicious behavior. These objects are usually non-visual, such as javascript, hidden malicious code in an image (steganography). However, those objects can also be visible such as hyperlinks, active code that change the data (e.g. macros). Even though is not within CDR process's scope, it might also alter the content if it's configured to do so.
For images and media files, we don’t “edit” the content, which means the original file and sanitized file will have the same content. However, the quality may be altered due to several steps performed to disarm the content by decoding, processing and encoding it again.
Known Issues
Not supporting Microsoft Office 95 document format
Conversion from HTML to an image would fail if the size of the HTML file is bigger than 90KB
Support AutoCAD file (.DWG) versions: 2004-2024. With version 2007-2009, when removing macro from the original file (if it has), opening sanitize file will display an error message "Failed to load project from storage" appeared but the file still works as usual
Support MPEG2 only
Support TXT in ASCII, UTF-8, Shift-JIS and ISO/IEC 8859-1 encoding only
When converting Excel files to TXT, only the first sheet is converted
Support AI in PDF format
If the file names inside XCT contain multibyte characters after sanitization, it will be different from the original. As a workaround, users can change the system default code page setting by the following steps: Settings > Time & language > Language & region > Administrative language settings > Change system locale, and check Beta: Use Unicode UTF-8 for worldwide language support