4 ms·

The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/herna

by owenfi 12y ago

The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936 https://twitter.com/hernano/status/514866681530023936 My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer. What are the common vectors beyond CGI-space for the average server? How do we find and test them?

eCa 12y ago
Not sure if it helps against this vulnerability, but using Git::Wrapper [1] makes for much nicer code than backticks. [1] https://metacpan.org/pod/Git::Wrapper https://metacpan.org/pod/Git::Wrapper
- owenfi 12y ago
  Awesome, thanks. Seems like it would've.
ordinary 12y ago
Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacker gets at the vulnerability.
- owenfi 12y ago
  Thanks. Suspected as much, but still a bit petrified that the shell var/func passed through perl to the backtick-shell.
- mutation 12y ago
  system() delegates to shell only in the case of one argument given to system().
- justincormack 12y ago
  Nice that "compatibility mode" does not bother to disable this technically non compatible behaviour...
odc 12y ago
Yes, this exploit can be used on any script or program that uses system(), whatever language you use. Using bash as the default /bin/sh is the real bug here.
- dllthomas 12y ago
  "Yes, this exploit can be used on any script or program that uses system(), whatever language you use." Unless that script or program sanitizes the environment before calling system(). In practice that might not presently be any scripts or programs, but it principle it's a tiny bit weaker than you say.

by owenfi 12y ago

eCa 12y ago

Not sure if it helps against this vulnerability, but using Git::Wrapper [1] makes for much nicer code than backticks. [1] https://metacpan.org/pod/Git::Wrapper https://metacpan.org/pod/Git::Wrapper

owenfi 12y ago
Awesome, thanks. Seems like it would've.

ordinary 12y ago

Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacker gets at the vulnerability.

owenfi 12y ago
Thanks. Suspected as much, but still a bit petrified that the shell var/func passed through perl to the backtick-shell.
mutation 12y ago
system() delegates to shell only in the case of one argument given to system().
justincormack 12y ago
Nice that "compatibility mode" does not bother to disable this technically non compatible behaviour...

odc 12y ago

Yes, this exploit can be used on any script or program that uses system(), whatever language you use. Using bash as the default /bin/sh is the real bug here.

dllthomas 12y ago
"Yes, this exploit can be used on any script or program that uses system(), whatever language you use." Unless that script or program sanitizes the environment before calling system(). In practice that might not presently be any scripts or programs, but it principle it's a tiny bit weaker than you say.