Re: Security flaws in recommended CGI setup?
Pauli Virtanen <[email protected]>
| Newsgroups | gmane.comp.python.spyce.general |
|---|---|
| Message-ID | <[email protected]> |
la, 2006-07-08 kello 03:03 +0300, Pauli Virtanen kirjoitti:
> I am wondering a bit about the recommended (F)CGI configuration on
> Apache 2:
>
> AddHandler spyce-cgi-handler spy
> Action spyce-cgi-handler "/spyce-cgi/run_spyceCGI.py"
> ScriptAlias /spyce-cgi/ "/usr/lib/spyce/"
> <Location /spyce-cgi/>
> <IfModule mod_fastcgi.c>
> # If mod_fastcgi not installed, we get plain cgi
> SetHandler fastcgi-script
> </IfModule>
> </Location>
>
> On spyce 2.0.3, this seems to allow anybody to request any file (under
> the spyce root, apparently?), overriding .htaccess permissions.
Apparently, php-cgi works around this by checking whether
Apache-specific REDIRECT_STATUS is set in environ. In spyce this should
be equivalent to something like the following:
def doSpyce( (stdin, stdout, stderr, environ) ):
if environ.get('REDIRECT_STATUS', '') != '200':
stdout.write("Content-type: text/html\n\n<html><body><h1>Forbidden</h1></body></html>\r\n")
return -1
path = None
if len(sys.argv)<=1 or not os.path.isfile(sys.argv[1]):
try: path = findScriptFile(environ['PATH_TRANSLATED'])
except: pass
result = spyceCmd.spyceMain(cgimode=1, cgiscript=path,
stdout=stdout, stdin=stdin, stderr=stderr, environ=environ)
return result
Perhaps it would be nice to also have Spyce behave like this by default?
Pauli Virtanen
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642