Tag Info

Hot answers tagged

78

To check for the CVE-2014-6271 vulnerability env x='() { :;}; echo vulnerable' bash -c "echo this is a test" it should NOT echo back the word vulnerable. To check for the CVE-2014-7169 vulnerability (warning: if yours fails it will make or overwrite a file called /tmp/echo that you can delete after, and need to delete before testing again ) cd /tmp; ...


31

Export a especially crafted environment variable that will be evaluated automatically by vulnerable versions of Bash: $ export testbug='() { :;}; echo VULNERABLE' Now execute a simple echo to see if Bash will evaluate the code in $testbug even though you've not used that variable yourself: $ bash -c "echo Hello" VULNERABLE Hello If it shows the ...


13

Which PHP binary are you using? The CLI or CGI? I suspect you need a CGI version of the binary for PHP to properly handle accept the environment variables and POST data if you pass that. The php-cgi binary implements the CGI interface, which allows you to pass parameters on the command line: php-cgi -f index.php left=1058 right=1067 class=A ...


12

You appear to be having this issue, which is because at some point nvi started opening files O_RDWR instead of O_RDONLY. If your vi is in fact nvi, I'd try using a different vi, say vim.


8

It looks like it goes through and makes an HTML table out of all of your environmental variables. Would you consider that nefarious? I'd consider anything that I didn't put on my own server to be nefarious, but that's me.


6

Running PHP as a module is usually more efficient, but means all scripts run under the same user account (what-ever account Apache runs as) which can pose security concerns in a shared environment. CGI is much slower as it starts a new PHP processes for every request that needs one, but can be configured to run each script as the user that owns it which can ...


6

The username will be available in the environment variable REMOTE_USER. This works for nearly every authentication method, should you ever start using digest or maybe even kerberos authentication.


5

Generally speaking, the only reason you would want to run CGI is in a shared environment. This allows you to have an suEXEC style (see: suPHP) arrangement where scripts are only executed as the owner's UID/GID and have limited permission to anything else on the filesystem. Otherwise mod_php is far more efficient and often easier to debug.


5

This is addressed here. Sadly, it seems to be difficult or impossible, given the constraints on the TFTP protocol. > Hi. > > Has there ever been any consideration to allowing the tftp server to > provide dynamic content? > Yes. The protocol makes it difficult. You pretty much have to guarantee that the contents is ...


4

Apache uses POST and GET to transfer data. It is probably POSTED to apache, which then sends it to the executable which could be C++, PHP, PERL, or any other number of programming languages. Your question should be "uploading via Apache" - Apache does not contain any files, the filesystem does. The apache module for cgi is called, surprisingly, mod_cgi.


4

I realise I'm very late to the party on this, but I think PHP FPM (FastCGI Process Manager) is the replacement. You need to use PHP 5.3.3 and use the --enable-fpm configure flag, or use the patch at the php-fpm website for earlier versions. An executable called php-fpm gets created in sapi/fpm.


4

Use the Status HTTP header. An example in Perl: #!/usr/bin/perl use strict; use warnings; print "Status: 404 Not Found\r\n"; print "Content-Type: text/html\r\n\r\n"; print "<h1>404 File not found!</h1>"; When using Perl (and other languages) however, excellent modules like CGI and CGI::Simple exist.


4

This answer suggests an Apache solution: <Location "/backend/XXX.php"> SetEnvIf Content-Type ^(multipart/form-data)(.*) NEW_CONTENT_TYPE=multipart/form-data-alternate$2 OLD_CONTENT_TYPE=$1$2 RequestHeader set Content-Type %{NEW_CONTENT_TYPE}e env=NEW_CONTENT_TYPE </Location>


4

When PHP is used as a module, it's more-or-less compiled into Apache's code itself. It's loaded for every request which means that it's loaded even for images, scripts, stylesheets and any other files that aren't PHP. It makes serving those pages slower. On the other hand, it makes PHP faster since Apache doesn't have to spawn additional processes. When PHP ...


4

In general, simpler means faster. However, you will not be sure that server x is faster than server y unless you try it yourself. You can also look at the already done benchmarks (if any) to have an idea about it. The advanced web server can be slower than a simple/basic server because of the added complexity. However, the advanced server can be better in ...


4

"Simple" and "Fast" aren't always related, especially in computing -- in this case, SimpleHTTPServer uses the simple file reading methods, the simple networking methods, clean and obvious processing that's easy for a new programmer to read, etc; nginx has a ton of complicated code to make use of the advanced high-speed file & network APIs in the most ...


4

Looking at the code, it appears to be decidedly naive (it would be possible to use it to leverage an attack) however it doesn't appear to have been written for that purpose. However if the code is on your website and you don't know why / how it got there nor what function it serves, then you shouldn't even have to ask us before removing it!


4

Use the DirectoryIndex directive: DirectoryIndex index.php Here's more info on how to use DirectoryIndex.


4

One solution might be to write a wrapper script for the relevant commands, heavily secure this script and allow a passwordless sudo for this. Edit: A wrapper script is just some short shell script where you offload the critical commands. You can secure this (e.g. make it aceessible only be the Apache user). For sudo, there are many questions already on ...


4

In a word, history. This is a very abbreviated summary of 15+ years of history (you can find out more on the Internet, if you are really interested): First, while PHP has all the features of a programming language, this wasn't always so. It started out as a "hypertext preprocessor" whose purpose was to be embedded in HTML pages and parsed by a CGI program ...


3

Try to put in a .htaccess file in the mysite directory : RedirectMatch ^/$ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi RedirectMatch ^/data/ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi RedirectMatch ^/pybloxsom-installation/ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi it might not work if your hosting provider doesn't ...


3

Start on the webserver where the request is being processed. It could be dwarfs with punchcards shouting over tin can's connected by strings for all anyone here knows. Look at the webserver, and start tracing the request.


3

Try using the SetEnvIf directive, coupled with env in your Header directive: SetEnvIf Request_URI "/MyCGI" is_cgi Header set X-Frame-Options some-value env=!is_cgi (or something close to that :-))


3

You can use the Location directive. <Location /url/fragment/to/my/cgi/script> Header unset X-Frame-Options </Location>


3

We have a Delphi 5 CGI application that experienced the same issue on IIS 7. Our solution was similar to the one Steven posted above, however, we don't completely comment out the line marius mentions above. When I did, I saw that any Request.ContentString statement would bring back an empty string in the application. Our solution was to implement the code ...


3

Running PHP via FastCGI will certainly give you the most flexibility. Not only can you safely use an mpm-worker Apache, you can even use another webserver altogether (e.g. nginx). But even when staying with Apache, "PHP via FastCGI" is at the moment not one option, but at least two: mod_fastcgi, mod_fcgid. On top of that, you can either use dynamic, static, ...


3

You are going to have to pick one. Install the cli/cgi binary or use wget/curl to make a request to your web server. If you want to protect the script you could adjust the configuration of the web server to block access except from local host, or add something to the script to return an error if the request didn't originate from the local host. Of course ...


3

Whether a Perl CGI program gets invoked or not depends primarily on the server configuration and the "path" part of the resource path. The Perl CGI script might return HTML (and usually this is the case). So requesting a script is often effectively requesting an html page, even if the URL doesn't contain ".html". If the URL is, say, ...


3

I don't believe there is any way to add a pool without restarting/reloading (as per this). I do think that redundancy is the best approach to this, I do believe, that you might accomplish what you want with reload. Since it is a graceful reload it should wait for the processes to finish. Essentially, pass the SIGUSR2 signal to php-fpm, and it will ...



Only top voted, non community-wiki answers of a minimum length are eligible