in reply to Re: Re: Hacking CGI - security and exploitation
in thread Hacking CGI - security and exploitation

Any time the system does something the programmer doesn't expect, you have potential problems.

In this case the programmer is using apparently equivalent file names - one for testing existence of a file and one for creating it. They are not equivalent though because the filesystem limit means that one name is invalid and the other is a file that already exists. So the code thought it was creating a new file to represent a new permission - but instead was replacing an existing access file.

So yes. The code presented makes the mistake described. But it would be a non-issue without a whole series of supporting mistakes - first and foremost of which is testing a different filename than you are creating!

Oh, to answer your other question? The "following line" was there because disagreements between Perl and system calls on the meaning of a null byte can cause all sorts of fun. Also shell scripts being confused by returns can cause other fun and games. Those characters were therefore known to be dangerous, and therefore were eliminated.

  • Comment on Re: Re: Re: Hacking CGI - security and exploitation

Replies are listed 'Best First'.
Re(4): Hacking CGI - security and exploitation
by cjf (Parson) on Jun 25, 2002 at 03:54 UTC

    Thanks for the reply. As for the following:

    # why was the following line there? # if($FORM{'path'} =~ m/\0|\r|\n/ig){ die "illegal characters"; }

    I was wondering why he bothers removing those characters from a variable that is never used. Perhaps he meant $FORM{'user'} in the $htaccess assignment to be $FORM{'path'}?

      You are correct. Hence again he demonstrated how to get security wrong. :-)