Some FastCGI frameworks helpfully set up environment variables in the web app---you know, just in case you run a sub-process and want it to work the same way it

Some FastCGI frameworks helpfully set up environment variables in the web app---you know, just in case you run a sub-process and want it to work the same way it would have from a CGI. See Per-Request Environment Variables at http://www.fastcgi.com/devkit/doc/fastcgi-prog-guide/ch1intro.htm http://www.fastcgi.com/devkit/doc/fastcgi-prog-guide/ch1intr... These aren't ubiquitous---but it also isn't just CGI programs that expose this vulnerability.