Security flaws in recommended CGI setup?

Hi all,

I am wondering a bit about the recommended (F)CGI configuration on
Apache 2:

    AddHandler spyce-cgi-handler spy
    Action spyce-cgi-handler "/spyce-cgi/run_spyceCGI.py"
    ScriptAlias /spyce-cgi/ "/usr/lib/spyce/"
    <Location /spyce-cgi/>
      <IfModule mod_fastcgi.c>
        # If mod_fastcgi not installed, we get plain cgi
        SetHandler fastcgi-script
      </IfModule>
    </Location>

On spyce 2.0.3, this seems to allow anybody to request any file (under
the spyce root, apparently?), overriding .htaccess permissions. For
example,

    http://host.com/spyce-cgi/run_spyceCGI.py/directory/file

would dump contents of spyceconfig.root + 'directory/file' regardless of
any restrictions in Apache.

It would be good to replace this recipe with a better one, or post a
warning about this behavior in the documentation. The alternative (F)CGI
configuration apparently does not have this flaw, but it requires
#!-lines in the scripts.

	Pauli Virtanen



Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642