5 ms·

So I took a great unix/linux systems programming class, http://sites.fas.harvard.edu/~lib215/ http://sites.fas.harvard.edu/~lib215/ where you learn about all of

by khaki54 12y ago

So I took a great unix/linux systems programming class, http://sites.fas.harvard.edu/~lib215/ http://sites.fas.harvard.edu/~lib215/ where you learn about all of the system software that you take for granted. Among other things, we had to write our own shell. There is an awful lot to consider, and most of it you are just trying to get to work properly. With regard to security, you feel like you are protected for the most part because the shell resides in userland and it's basically understood that you shouldn't trust foreign shell scripts. Is the worry here that the code gets executed by the kernel or superuser, enabling privilege escalation? Otherwise it wouldn't be a big deal that extra code is executed by a function declaration.

dtech 12y ago
It allows arbitrary code execution if an attacker can modify environment variables through other software. Most webservers put certain HTTP headers in environment variables. I can certainly see the how this could be exploited.
- Someone1234 12y ago
  > Most webservers put certain HTTP headers in environment variables. I legitimately don't understand why they might do such a thing. Can you explain?
  - yxhuvud 12y ago
    They need to pass data into a CGI script somehow.
    - vidarh 12y ago
      But a shell will rarely be involved in executing a CGI, unless that CGI itself executes one. And who still uses CGI scripts? Not to say nobody will be bitten by that, but I don't think that's going to be all that widespread.
      - kevinr 12y ago
        Many people don't realize they use CGI scripts, but a lot of people are going to discover they do today.
      - peterwwillis 12y ago
        Have you ever looked at the backend web interface of some of the most popular residential wifi routers? It's shell script. Why? It's a cheap and accessible interpreted language; no need to clutter up your tiny embedded OS with the huge requirements of php, perl, etc when you have all the tools you need in busybox. CGI apps execute shell scripts all the time. Even if an app executes an app executes an app executes an app, if that app four layers down runs a shell script, the environment is still passed down. Turtles, dude.
        justincormack 12y ago
        Fortunately they are unlikely to install bash at all on a router.
        peterwwillis 12y ago
        Routers definitely have shells, it's just a matter of whether it's bash or something else that might also be vulnerable.
        justincormack 12y ago
        Bash is big and bloated, and you already have the busybox sh probably. However apparently some do have bash....
      - rb12345 12y ago
        It could be a simple one-line script that wraps the real command, setting memory limits and the like first. (I used a similar trick to prevent Skype using up all my memory in the past.)
    - ptaffs 12y ago
      agreed, also Browser User Agent, referrer are all passed by the client and sent to Apache, which pushes them into environment variables.
  - daurnimator 12y ago
    That's how CGI passes most things. see https://en.wikipedia.org/wiki/Common_Gateway_Interface#Syntax https://en.wikipedia.org/wiki/Common_Gateway_Interface#Synta...

by khaki54 12y ago

dtech 12y ago

It allows arbitrary code execution if an attacker can modify environment variables through other software. Most webservers put certain HTTP headers in environment variables. I can certainly see the how this could be exploited.

Someone1234 12y ago
> Most webservers put certain HTTP headers in environment variables. I legitimately don't understand why they might do such a thing. Can you explain?
- yxhuvud 12y ago
  They need to pass data into a CGI script somehow.
  - vidarh 12y ago
    But a shell will rarely be involved in executing a CGI, unless that CGI itself executes one. And who still uses CGI scripts? Not to say nobody will be bitten by that, but I don't think that's going to be all that widespread.
    - kevinr 12y ago
      Many people don't realize they use CGI scripts, but a lot of people are going to discover they do today.
    - peterwwillis 12y ago
      Have you ever looked at the backend web interface of some of the most popular residential wifi routers? It's shell script. Why? It's a cheap and accessible interpreted language; no need to clutter up your tiny embedded OS with the huge requirements of php, perl, etc when you have all the tools you need in busybox. CGI apps execute shell scripts all the time. Even if an app executes an app executes an app executes an app, if that app four layers down runs a shell script, the environment is still passed down. Turtles, dude.
      - justincormack 12y ago
        Fortunately they are unlikely to install bash at all on a router.
        peterwwillis 12y ago
        Routers definitely have shells, it's just a matter of whether it's bash or something else that might also be vulnerable.
        justincormack 12y ago
        Bash is big and bloated, and you already have the busybox sh probably. However apparently some do have bash....
    - rb12345 12y ago
      It could be a simple one-line script that wraps the real command, setting memory limits and the like first. (I used a similar trick to prevent Skype using up all my memory in the past.)
  - ptaffs 12y ago
    agreed, also Browser User Agent, referrer are all passed by the client and sent to Apache, which pushes them into environment variables.
- daurnimator 12y ago
  That's how CGI passes most things. see https://en.wikipedia.org/wiki/Common_Gateway_Interface#Syntax https://en.wikipedia.org/wiki/Common_Gateway_Interface#Synta...