10 ms·
Would a python web server (gunicorn, wsgi) behind nginx be vulnerable to this kind of problem? I'm just pondering all the python library code out there which r
by s_kilk 12y ago
Would a python web server (gunicorn, wsgi) behind nginx be vulnerable to this kind of problem?
I'm just pondering all the python library code out there which relies on calls to subprocess.Popen() to get things done. It seems like dynamic scripting languages with a tendancy to shell out to the system could be at risk of this or similar attacks.
- maxerickson 12y agoIt has to be subprocess.Popen(..., shell=True) to be a problem here, the default is shell=False. (avoiding implicit shell=True was one of the motivations for the subprocess module)
- fiedzia 12y agoNo, because wsgi (i is for an interface here) does not use shell to pass data. Subprocess.Popen would only be a problem if it passes user-generated data as environment variables, and it doesn't do that by default. That's rarely needed, but you may want to review your code to be sure.
- rhizome31 12y agoActually I just tried on an app that runs on Gunicorn and does a Popen with shell=True, and it is vulnerable. A simple curl -A '() { :;}; touch /tmp/owned' did create the file on the server.