4 ms·
Who the hell writes CGI scripts in 2014? There is a reason PHP is to be kept away and not touched with a ten meter stick, it seems to spawn a shell for weird r
by antocv 12y ago
Who the hell writes CGI scripts in 2014?
There is a reason PHP is to be kept away and not touched with a ten meter stick, it seems to spawn a shell for weird reasons, I dont think python or groovy apps do that. They're safe, unless you somewhere specifically invoke System.getRuntime().run("bash");
- smsm42 12y agoPHP never "spawns shell for weird reasons" - it would spawn shell if you ask it to spawn shell. Just as any other language would, if you ask it. Still, many apps may use shell indirectly - e.g. to execute some system function, to call out to some tool, etc. - and those may be vulnerable even if original code was not CGI script. Moreover, you don't have to run specifically bash - any command execution may go through shell, which may be bash, e.g. Runtime.getRuntime().exec() in Java. Thus it may be not very easy to pinpoint all the places where this bug could sneak in.
- vorg 12y ago> groovy apps do that [... if] you somewhere specifically invoke System.getRuntime().run("bash"); That's a one-liner in Groovy, written in the Java style of chained method calls, which is the direct equivalent of spawning a shell in non-JVM languages, so that's not an argument for using Groovy instead of PHP.