1

I am adding a feedback form to a web page and would like to know if it is safe to simply filter the contents of the TEXTAREA element (after decoding) through the 'mail' command to send an e-mail to the page's maintainer.

I have looked at the man page and cannot see a way to abuse this, in particular as long as 'mail' does not run in interactive mode, tilde escapes are disabled and '.' on a line by itself does not terminate the message body.

But is there any other danger I should be aware of?

The command looks something like:

echo "$MESSAGE_BODY" | mail [email protected] -s 'Website feedback'

6 Answers 6

0

Don't use mail, which is meant to be a line-oriented end-user program. Use the "sendmail" command (but don't use that cursed piece of shblip that is the sendmail program) included in most MTA. It's meant to be used programatically. I know that postfix and qmail, for example, include it.

cat mailmessage.txt | sendmail -ffrom@yourhost recipient@theirhost

Addendum: it's not necessarily "dangerous" to call a program from a CGI, as long as you know what you're doing. In particular, just as in this case, make sure that the program you're calling is not intended for end-users or is not called in interactive mode (most such programs will allow spawning a shell!)

2

Yes it is dangerous. The mail message can contain lines beginning with a tilde ~ character that are treated as escape sequences by the mail program. This includes shell escapes and adding new recipients. (mmmm, spam!)

Just have a look at

$ man mail

To see what I mean.

2
  • 1
    I have looked at that and it says these escapes only work in interactive mode (when standard input is a terminal or if forced with the -I option.) In this case the standard input is a pipe, which should cause these functions to be disabled.
    – finnw
    May 31, 2009 at 1:18
  • Good point. I would suggest you make every effort to sanitize the mail text just in case.
    – Sekenre
    May 31, 2009 at 14:17
1

It's great that you're asking this - many people just want to get the job done, and so introduce a whole bunch of vulnerabilities on the bases that "Ahhh... It'll be fine".

Having said that, I think it's fine to do what you're doing - but as long as you use a filter - and not a filter you've written yourself, but one that is open source (hence open to public scrutiny), mature (has been around for a while). I'd also make sure the filter strips out any HTML tags and content that may be nesting some nasty XSS attacks.

Use an open-source library where you can find one is basically what I'm getting at. (Don't ever use any closed security applications - they're all doomed to fail - and I can sign my name on that comment).

2
  • XSS shouldn't be a problem as the text is never displayed in a web page, only e-mailed.
    – finnw
    May 31, 2009 at 7:53
  • 1
    Yes, but the viewer - unless you have full control of their clients - could be using a HTML-enabled mail client. In addition to this, the term XSS doesn't necessarily mean web/js (although it usually is), it can be generalized as any kind of attack that is the result of exploiting an input field to load malicious code.
    – khosrow
    May 31, 2009 at 8:09
0

I'd try to avoid calling any commands from a CGI. I am sure whatever language you're using should have a library to send emails.

1
  • +1 I agree. Are you using shell scripts for your CGI app?
    – squillman
    May 31, 2009 at 3:28
0

It's a huge security hole. Here's a resource for writing safe CGI code.

Just to give you an idea, here's a list of characters with special uses that you need to be aware of:

Character Name   Character   Problems
backslash        \   quoting
double quote     "   quoting
single quote     '   quoting
dollar sign      $   variable substitution
ampersand        &   command separator
greater than     >   I/O redirection
less than        <   I/O redirection
asterisk         *   file globbing
question mark    ?   file globbing
left bracket     [   file globbing
right bracket    ]   file globbing
left paren       (   word separator
right paren      )   word separator
pipe             |   command separator
backtick         `   subcommand execution
semicolon        ;   command separator
pound sign       #   comment character (sh only)
caret            ^   command separator (sh only)
exclamation      !   history execution (csh only)
tilde            ~   username expansion (csh only)
carriage return  <ascii 13>   command separator
line feed        <ascii 10>   command separator
space            word separator
tab              ascii 9   word separator
NULL             ascii 0   truncates input

Use a library where someone that someone else has already implemented and debugged. Email forms have been done before, don't re-invent the wheel!

1
  • 2
    I don't think the shell command is vulnerable. It's a fixed string. The form data is in a variable.
    – finnw
    May 31, 2009 at 1:16
0

What kind of CGI do you use? Most cgi languages / frameworks have support for sending mails. They are always better than calling external commands. Well PHP's mail() is really bad, but still better that calling external commands.

From the security perspective sending mails with SMTP (e.g. to localhost) is recommended.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .