4 ms·

There's a reason this isn't talked about, it's not an actual legitimate/common vector to compromise a server.

by ZoF 12y ago

LunaSea 12y ago
Could you go into more details ?
- ninkendo 12y ago
  In most environments it would be insane to allow anybody untrusted to put files on your server. That includes a trusted sysadmin extracting unknown tar files on your server. It's a case of "if they got this far, you're already fucked."
mschuster91 12y ago
Oh it is. Many people do e.g. backups of all userdirs by using tar * as root inside a cron, thus rendering themselves vulnerable.
Maken 12y ago
Yes, because no user-uploaded filename will ever be parsed by a maintenance script in a server.
- ninkendo 12y ago
  Not by any sane person, no. Why are you letting people upload and name their own files on your server? Should we be posting articles about the vulnerabilities in the finger daemon or Solaris 8's NIS implementation, while we're at it? It seems like this article is aiming towards shared servers where you actually allow shell login to "untrusted" users, which IMO is a relic of days long past, that only really persists at (maybe) universities. Hell, even at the university I last worked at 6 years ago we just gave everybody their own VM. And nowadays I wouldn't even need to give them that... students can download and run a vagrant environment on their personal machine in like 2 commands. It's not to say there's no audience for articles like this... I'm sure there's plenty of environments out there that still follow the multi-user server model from the 1970's, and I certainly pity anyone who has to administer those types of systems. But it certainly should be no surprise to anyone that there's a lot of malicious things you can do if you have shell access to a system (or to your point, the ability to upload arbitrarily-named files with arbitrary content. shudder)
  - vacri 12y ago
    This kind of article is good to keep bubbling up over time, to educate new users in best practices. Not everyone is a 20-year unix admin that's seen a bit of everything.
  - 6c6db4ab 12y ago
    Lets say you have web server, this web server have web application that allows users to upload files. Web application is sane and doesn't allow path traversal and have proper .htaccess inside of the upload directory. Now all you need is a user who kindly requests for a copy of uploaded files. If you're not aware of this issue (and you must be "actively aware" i.e. watch out for it all the time) you can do something that shouldn't be possible.
    - ninkendo 12y ago
      I'm a bit late replying, but I wouldn't consider an application that allows users to upload files, and pick their names to be a sane application. Do you think imgur (as an example) lets users name their files? What about stuff like the defunct megaupload or other file sharing sites? You get to pick filenames but that's really metadata... the URLs and (presumably) the underlying file storage structure are database-driven.

There's a reason this isn't talked about, it's not an actual legitimate/common vector to compromise a server.

by ZoF 12y ago

There's a reason this isn't talked about, it's not an actual legitimate/common vector to compromise a server.

LunaSea 12y ago

Could you go into more details ?

ninkendo 12y ago
In most environments it would be insane to allow anybody untrusted to put files on your server. That includes a trusted sysadmin extracting unknown tar files on your server. It's a case of "if they got this far, you're already fucked."

mschuster91 12y ago

Oh it is. Many people do e.g. backups of all userdirs by using tar * as root inside a cron, thus rendering themselves vulnerable.

Maken 12y ago

Yes, because no user-uploaded filename will ever be parsed by a maintenance script in a server.

ninkendo 12y ago
Not by any sane person, no. Why are you letting people upload and name their own files on your server? Should we be posting articles about the vulnerabilities in the finger daemon or Solaris 8's NIS implementation, while we're at it? It seems like this article is aiming towards shared servers where you actually allow shell login to "untrusted" users, which IMO is a relic of days long past, that only really persists at (maybe) universities. Hell, even at the university I last worked at 6 years ago we just gave everybody their own VM. And nowadays I wouldn't even need to give them that... students can download and run a vagrant environment on their personal machine in like 2 commands. It's not to say there's no audience for articles like this... I'm sure there's plenty of environments out there that still follow the multi-user server model from the 1970's, and I certainly pity anyone who has to administer those types of systems. But it certainly should be no surprise to anyone that there's a lot of malicious things you can do if you have shell access to a system (or to your point, the ability to upload arbitrarily-named files with arbitrary content. shudder)
- vacri 12y ago
  This kind of article is good to keep bubbling up over time, to educate new users in best practices. Not everyone is a 20-year unix admin that's seen a bit of everything.
- 6c6db4ab 12y ago
  Lets say you have web server, this web server have web application that allows users to upload files. Web application is sane and doesn't allow path traversal and have proper .htaccess inside of the upload directory. Now all you need is a user who kindly requests for a copy of uploaded files. If you're not aware of this issue (and you must be "actively aware" i.e. watch out for it all the time) you can do something that shouldn't be possible.
  - ninkendo 12y ago
    I'm a bit late replying, but I wouldn't consider an application that allows users to upload files, and pick their names to be a sane application. Do you think imgur (as an example) lets users name their files? What about stuff like the defunct megaupload or other file sharing sites? You get to pick filenames but that's really metadata... the URLs and (presumably) the underlying file storage structure are database-driven.