8 ms·
It allows arbitrary code execution if an attacker can modify environment variables through other software. Most webservers put certain HTTP headers in environ
by dtech 12y ago
It allows arbitrary code execution if an attacker can modify environment variables through other software.
Most webservers put certain HTTP headers in environment variables. I can certainly see the how this could be exploited.
- Someone1234 12y ago> Most webservers put certain HTTP headers in environment variables. I legitimately don't understand why they might do such a thing. Can you explain?
- yxhuvud 12y agoThey need to pass data into a CGI script somehow.
- vidarh 12y agoBut a shell will rarely be involved in executing a CGI, unless that CGI itself executes one. And who still uses CGI scripts? Not to say nobody will be bitten by that, but I don't think that's going to be all that widespread.
- kevinr 12y agoMany people don't realize they use CGI scripts, but a lot of people are going to discover they do today.
- peterwwillis 12y agoHave you ever looked at the backend web interface of some of the most popular residential wifi routers? It's shell script. Why? It's a cheap and accessible interpreted language; no need to clutter up your tiny embedded OS with the huge requirements of php, perl, etc when you have all the tools you need in busybox. CGI apps execute shell scripts all the time. Even if an app executes an app executes an app executes an app, if that app four layers down runs a shell script, the environment is still passed down. Turtles, dude.
- justincormack 12y agoFortunately they are unlikely to install bash at all on a router.
- peterwwillis 12y agoRouters definitely have shells, it's just a matter of whether it's bash or something else that might also be vulnerable.
- justincormack 12y agoBash is big and bloated, and you already have the busybox sh probably. However apparently some do have bash....
- rb12345 12y agoIt could be a simple one-line script that wraps the real command, setting memory limits and the like first. (I used a similar trick to prevent Skype using up all my memory in the past.)
- ptaffs 12y agoagreed, also Browser User Agent, referrer are all passed by the client and sent to Apache, which pushes them into environment variables.
- daurnimator 12y agoThat's how CGI passes most things. see https://en.wikipedia.org/wiki/Common_Gateway_Interface#Syntax https://en.wikipedia.org/wiki/Common_Gateway_Interface#Synta...