4 ms·

Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.

phoronixrly 5y ago
Yeah, maybe should be mentioned in the title to save people from PTSD over the holidays...
- xaner4 5y ago
  If I could have have changed the title I would have added something to make it give less PTSD
johnisgood 5y ago
> Most app server configuration files allow you to load and run arbitrary code I do not understand this. Configuration files allow you to load and run arbitrary code? Is this actually a thing? What are they using for configuration files?! Tcl?
- rst 5y ago
  In a typical installation of something like Apache Tomcat, there will be config files that tell the server what code to load and run. If you can modify those config files...
- filleokus 5y ago
  If I remember correctly e.g Django and Flask uses plain old python-files for configs. Don’t know if it’s common in the Node landscape but probably? I don’t know how common it is to specify paths to/file name for DLL’s in config to load at runtime for C#, but probably not totally unheard of? And if you can edit the config, maybe you can place a DLL somewhere as well…? (But at the some time if you can edit the config, maybe you can just replace/patch the main binary in the first place…)
  - teh_klev 5y ago
    You can configure ASP.NET to load HTTP Handlers and Modules for use in the request/response pipeline via the web.config file (from the file system, not over HTTP). But if your attacker has gotten so far as to be able to tamper with these config files then it's probably game-over already.
  - capableweb 5y ago
    > Don’t know if it’s common in the Node landscape but probably? Webpack is (arguably) one of the most common tools in the nodejs/browser ecosystem, and it has a regular JS file as it's config file (usually named `webpack.config.js`).
    - johnisgood 5y ago
      I am still stuck at using INI/JSON/TOML for configuration files. :D
      - capableweb 5y ago
        Just remember that just because you're using .ini/.json/.toml files doesn't mean there isn't any way of executing code from changing their values, it's up to whatever is using the files if there is any way of executing code via them. One example is package.json. It's a JSON file, yeah, and normally doesn't contain any code. But one of the fields is `scripts` which can contain a object with a key like `preinstall` (and more) that runs those as shell commands at different lifecycle of using `npm`. So just because you're using those languages/syntaxes, doesn't mean there isn't any way of executing code via them.
        johnisgood 5y ago
        That is fairs and true. :) Thanks!
- blacksqr 5y ago
  >What are they using for configuration files?! Tcl? This would be preferable, since Tcl allows you to configure safe interpreters that can deny use of any specified set of commands, including those that give access to files and network services. https://www.tcl.tk/man/tcl8.6/TclCmd/safe.html https://www.tcl.tk/man/tcl8.6/TclCmd/safe.html
frogger8 5y ago
Correct! https://twitter.com/nas_bench/status/1475940057924222977?s=20 https://twitter.com/nas_bench/status/1475940057924222977?s=2...

phoronixrly 5y ago

Yeah, maybe should be mentioned in the title to save people from PTSD over the holidays...

xaner4 5y ago
If I could have have changed the title I would have added something to make it give less PTSD

johnisgood 5y ago

> Most app server configuration files allow you to load and run arbitrary code I do not understand this. Configuration files allow you to load and run arbitrary code? Is this actually a thing? What are they using for configuration files?! Tcl?

rst 5y ago
In a typical installation of something like Apache Tomcat, there will be config files that tell the server what code to load and run. If you can modify those config files...
filleokus 5y ago
If I remember correctly e.g Django and Flask uses plain old python-files for configs. Don’t know if it’s common in the Node landscape but probably? I don’t know how common it is to specify paths to/file name for DLL’s in config to load at runtime for C#, but probably not totally unheard of? And if you can edit the config, maybe you can place a DLL somewhere as well…? (But at the some time if you can edit the config, maybe you can just replace/patch the main binary in the first place…)
- teh_klev 5y ago
  You can configure ASP.NET to load HTTP Handlers and Modules for use in the request/response pipeline via the web.config file (from the file system, not over HTTP). But if your attacker has gotten so far as to be able to tamper with these config files then it's probably game-over already.
- capableweb 5y ago
  > Don’t know if it’s common in the Node landscape but probably? Webpack is (arguably) one of the most common tools in the nodejs/browser ecosystem, and it has a regular JS file as it's config file (usually named `webpack.config.js`).
  - johnisgood 5y ago
    I am still stuck at using INI/JSON/TOML for configuration files. :D
    - capableweb 5y ago
      Just remember that just because you're using .ini/.json/.toml files doesn't mean there isn't any way of executing code from changing their values, it's up to whatever is using the files if there is any way of executing code via them. One example is package.json. It's a JSON file, yeah, and normally doesn't contain any code. But one of the fields is `scripts` which can contain a object with a key like `preinstall` (and more) that runs those as shell commands at different lifecycle of using `npm`. So just because you're using those languages/syntaxes, doesn't mean there isn't any way of executing code via them.
      - johnisgood 5y ago
        That is fairs and true. :) Thanks!
blacksqr 5y ago
>What are they using for configuration files?! Tcl? This would be preferable, since Tcl allows you to configure safe interpreters that can deny use of any specified set of commands, including those that give access to files and network services. https://www.tcl.tk/man/tcl8.6/TclCmd/safe.html https://www.tcl.tk/man/tcl8.6/TclCmd/safe.html

frogger8 5y ago

Correct! https://twitter.com/nas_bench/status/1475940057924222977?s=20 https://twitter.com/nas_bench/status/1475940057924222977?s=2...