Tag Info

Hot answers tagged

78

To check for the CVE-2014-6271 vulnerability env x='() { :;}; echo vulnerable' bash -c "echo this is a test" it should NOT echo back the word vulnerable. To check for the CVE-2014-7169 vulnerability (warning: if yours fails it will make or overwrite a file called /tmp/echo that you can delete after, and need to delete before testing again ) cd /tmp; ...


31

Export a especially crafted environment variable that will be evaluated automatically by vulnerable versions of Bash: $ export testbug='() { :;}; echo VULNERABLE' Now execute a simple echo to see if Bash will evaluate the code in $testbug even though you've not used that variable yourself: $ bash -c "echo Hello" VULNERABLE Hello If it shows the ...


14

Which PHP binary are you using? The CLI or CGI? I suspect you need a CGI version of the binary for PHP to properly handle accept the environment variables and POST data if you pass that. The php-cgi binary implements the CGI interface, which allows you to pass parameters on the command line: php-cgi -f index.php left=1058 right=1067 class=A ...


12

You appear to be having this issue, which is because at some point nvi started opening files O_RDWR instead of O_RDONLY. If your vi is in fact nvi, I'd try using a different vi, say vim.


8

The username will be available in the environment variable REMOTE_USER. This works for nearly every authentication method, should you ever start using digest or maybe even kerberos authentication.


8

It looks like it goes through and makes an HTML table out of all of your environmental variables. Would you consider that nefarious? I'd consider anything that I didn't put on my own server to be nefarious, but that's me.


6

Running PHP as a module is usually more efficient, but means all scripts run under the same user account (what-ever account Apache runs as) which can pose security concerns in a shared environment. CGI is much slower as it starts a new PHP processes for every request that needs one, but can be configured to run each script as the user that owns it which can ...


6

Use the Status HTTP header. An example in Perl: #!/usr/bin/perl use strict; use warnings; print "Status: 404 Not Found\r\n"; print "Content-Type: text/html\r\n\r\n"; print "<h1>404 File not found!</h1>"; When using Perl (and other languages) however, excellent modules like CGI and CGI::Simple exist.


5

Generally speaking, the only reason you would want to run CGI is in a shared environment. This allows you to have an suEXEC style (see: suPHP) arrangement where scripts are only executed as the owner's UID/GID and have limited permission to anything else on the filesystem. Otherwise mod_php is far more efficient and often easier to debug.


5

This is addressed here. Sadly, it seems to be difficult or impossible, given the constraints on the TFTP protocol. > Hi. > > Has there ever been any consideration to allowing the tftp server to > provide dynamic content? > Yes. The protocol makes it difficult. You pretty much have to guarantee that the contents is ...


4

Looking at the code, it appears to be decidedly naive (it would be possible to use it to leverage an attack) however it doesn't appear to have been written for that purpose. However if the code is on your website and you don't know why / how it got there nor what function it serves, then you shouldn't even have to ask us before removing it!


4

One solution might be to write a wrapper script for the relevant commands, heavily secure this script and allow a passwordless sudo for this. Edit: A wrapper script is just some short shell script where you offload the critical commands. You can secure this (e.g. make it aceessible only be the Apache user). For sudo, there are many questions already on ...


4

This answer suggests an Apache solution: <Location "/backend/XXX.php"> SetEnvIf Content-Type ^(multipart/form-data)(.*) NEW_CONTENT_TYPE=multipart/form-data-alternate$2 OLD_CONTENT_TYPE=$1$2 RequestHeader set Content-Type %{NEW_CONTENT_TYPE}e env=NEW_CONTENT_TYPE </Location>


4

In general, simpler means faster. However, you will not be sure that server x is faster than server y unless you try it yourself. You can also look at the already done benchmarks (if any) to have an idea about it. The advanced web server can be slower than a simple/basic server because of the added complexity. However, the advanced server can be better in ...


4

"Simple" and "Fast" aren't always related, especially in computing -- in this case, SimpleHTTPServer uses the simple file reading methods, the simple networking methods, clean and obvious processing that's easy for a new programmer to read, etc; nginx has a ton of complicated code to make use of the advanced high-speed file & network APIs in the most ...


4

Use the DirectoryIndex directive: DirectoryIndex index.php Here's more info on how to use DirectoryIndex.


4

Apache uses POST and GET to transfer data. It is probably POSTED to apache, which then sends it to the executable which could be C++, PHP, PERL, or any other number of programming languages. Your question should be "uploading via Apache" - Apache does not contain any files, the filesystem does. The apache module for cgi is called, surprisingly, mod_cgi.


4

I realise I'm very late to the party on this, but I think PHP FPM (FastCGI Process Manager) is the replacement. You need to use PHP 5.3.3 and use the --enable-fpm configure flag, or use the patch at the php-fpm website for earlier versions. An executable called php-fpm gets created in sapi/fpm.


4

When PHP is used as a module, it's more-or-less compiled into Apache's code itself. It's loaded for every request which means that it's loaded even for images, scripts, stylesheets and any other files that aren't PHP. It makes serving those pages slower. On the other hand, it makes PHP faster since Apache doesn't have to spawn additional processes. When PHP ...


4

In a word, history. This is a very abbreviated summary of 15+ years of history (you can find out more on the Internet, if you are really interested): First, while PHP has all the features of a programming language, this wasn't always so. It started out as a "hypertext preprocessor" whose purpose was to be embedded in HTML pages and parsed by a CGI program ...


3

Move your pictures out of /usr/lib//cgi-bin/ folder and put them somewhere within /var/www/ Update your paths accordingly. Every time you trying to access any file within cgi-bin path it is expecting that content will be generated by executing that file.


3

When you access /monitorix in a browser, you are accessing /var/lib/monitorix/www. Your Directory block allows access to /var/lib/monitorix/www/cgi, not /var/lib/monitorix/www. Either change the Alias to: Alias /monitorix /var/lib/monitorix/www/cgi or add an additional Directory block: <Directory /var/lib/monitorix/www/> <IfModule ...


3

The IMHO easiest (and quite secure) way is an indirect one: Make the webpage create a file somewhere if the user clicks the button and modify your script to only run if the file exists and delete it afterwards. Then run this script from a cron job every minute. You can even use this file to supply arguments to the script (which of course needs special ...


3

Another answer, since this is an entirely different (and much more generic) approach. One could argue that this is the canonical way to do such things :) Put your apache user (however it is named, I assume www-data) into the sudoers file (with visudo) with a very specific line that allows him to only run yourscript.py and only from the local machine ...


3

Try using the SetEnvIf directive, coupled with env in your Header directive: SetEnvIf Request_URI "/MyCGI" is_cgi Header set X-Frame-Options some-value env=!is_cgi (or something close to that :-))


3

You can use the Location directive. <Location /url/fragment/to/my/cgi/script> Header unset X-Frame-Options </Location>


3

Try to put in a .htaccess file in the mysite directory : RedirectMatch ^/$ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi RedirectMatch ^/data/ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi RedirectMatch ^/pybloxsom-installation/ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi it might not work if your hosting provider doesn't ...


3

We have a Delphi 5 CGI application that experienced the same issue on IIS 7. Our solution was similar to the one Steven posted above, however, we don't completely comment out the line marius mentions above. When I did, I saw that any Request.ContentString statement would bring back an empty string in the application. Our solution was to implement the code ...


3

Start on the webserver where the request is being processed. It could be dwarfs with punchcards shouting over tin can's connected by strings for all anyone here knows. Look at the webserver, and start tracing the request.



Only top voted, non community-wiki answers of a minimum length are eligible