6 ms·
I know this is just for fun and not intended for production use. But what could be potential exploits and vulnerabilities in this server?
by gberger 5y ago
I know this is just for fun and not intended for production use. But what could be potential exploits and vulnerabilities in this server?
- sneak 5y agoGET ../../../etc/passwd
- asah 5y agosandbox it? e.g. docker, OpenBSD chroot?
- jpegqs 5y agoI have provided protection against this.
- Someone 5y agoI don’t think it compiles on windows (netdb.h doesn’t exist there, I think), so you’re fine there, too, from a security viewpoint. However, if somebody did a quick and dirty “make it compile” port (include winsock2.h instead and, possibly, replace some functions/argument types), I think that would create security vulnerabilities because the fopen on Windows might support using backslashes as path separators. Even if it doesn’t, there’s UNC paths (https://en.wikipedia.org/wiki/Path_(computing)#Universal_Naming_Convention https://en.wikipedia.org/wiki/Path_(computing)#Universal_Nam...) to worry about. That made me wonder whether other OSes might have similar features. Reading https://pubs.opengroup.org/onlinepubs/007904975/basedefs/xbd_chap04.html https://pubs.opengroup.org/onlinepubs/007904975/basedefs/xbd..., I’m not sure that forbids Unix from doing something similar. It says “A pathname that begins with two successive slashes may be interpreted in an implementation-defined manner, although more than two leading slashes shall be treated as a single slash.” That opens the door for doing special things for paths that start with //, for example by supporting “//machine:foo/bar/baz” on clusters.
- Arch-TK 5y agoGET //etc/passwd HTTP/1.0 I noticed the check for "/." in the path and I chuckled. I think if you strip all leading forward slashes and check for "/." then you may have it be "secure" on linux at least. Your best bet for fixing this on windows is making sure the code never compiles on windows because god knows what on earth the path handling is like on windows.
- NieDzejkob 5y agoLooks like you didn't even bother to test your claim.
- jart 5y agoGET %C0%AE%C0%AE/%C0%AE%C0%AE/%C0%AE%C0%AE/etc/passwd
- jpegqs 5y agoIt won't be a problem in this code because "%" is not handled. But could be a vulnerability for more implemented HTTP servers, and a few days ago I got this idea too.
- jpegqs 5y agoI tried to make it secure and protect from such things. If someone finds vulnerabilities, please let me know.
- jijji 5y agouse strncpy() instead of strcpy()
- jpegqs 5y agoIt's calculated that strcpy() should never cause a buffer overflow here.
- throwaway984393 5y agoYou should still never use functions which have well known security flaws if there is a widely available alternative which avoids the flaws. Secure programming isn't just about calculating whether your current code has a bug, it's also about writing code that avoids bugs.
- astrobe_ 5y agoThank you Mr Weekend Secure Programming Expert. strncpy() has equally dangerous semantics, though.
- jart 5y agostrncpy() isn't dangerous. People have their heads so twisted around muh security that they don't even know what the function was intended to do. The purpose of strncpy() is to prepare a static search buffer so you can do things like perform binary search: static const struct People { char name[8]; int age; } kPeople[] = { {"alice", 29}, // {"bob", 42}, // }; int GetAge(const char *name) { char k[8]; int m, l, r; l = 0; r = ARRAYLEN(kPeople) - 1; strncpy(k, s, 8); while (l <= r) { m = (l + r) >> 1; if (READ64BE(kPeople[m].s) < READ64BE(k)) { l = m + 1; } else if (READ64BE(kPeople[m].s) > READ64BE(k)) { r = m - 1; } else { return kPeople[m].age; } } return -1; } It was a really common practice back in the 70's and 80's when the function was designed for databases to use string fields of a specific fixed length.
- deleted 5y ago[deleted]
- Matthias247 5y agoRegarding availabiltiy: It only handles a single connection, and has no timeouts. If someone just connects, and does nothing else, the server will be unavailable.
- SahAssar 5y agoFor the interested: this is called (or at least similar to) a slow loris attack: https://en.wikipedia.org/wiki/Slowloris_(computer_security) https://en.wikipedia.org/wiki/Slowloris_(computer_security)