Re: Security bug in pyblosxom (reading of arbitrary directories)

On 02/13/06 05:42, will guaraldi wrote:
> PyBlosxom 1.3.1 has two lines in pyblosxom.py before line 1040 like this:
> 
>      if path_info.startswith("/"):
>          path_info = path_info[1:]
> 
> So when passed a path_info o "/etc", it strips off the first / making it 
> "etc".  However, it won't strip multiple / and that's a possible issue.
> 
> So I tried:
> 
>     http://site/cgi-bin/pyblosxom.cgi///etc
> 
> and the ///etc gets turned into "/etc" by the web-server.  I'm running 
> Apache 2.0.55 (Debian's apache2 2.0.55-1 package) and running PyBlosxom as 
> a cgi script.
> 
> I'll adjust the code to fix the possibility of having multiple / and I'll 
> look for other os.path.join issues, but I can't reproduce this issue and I 
> don't know what situations it pops up in.
> 
> If anyone else can reproduce this issue with PyBlosxom 1.3.1 and what 
> situations they can reproduce it in, that'd help a lot.
> 
> /will
> 

Same picture here. Can't reproduce.
Neither with mod_python nor running as cgi.

Gentoo Linux
Python 2.4.2
Apache 2.0.55-r1
Pyblosxom 1.3 devel (CVS checkout of 20060115)

Pyblosxom is configured as:

ScriptAlias /weblog-cgi /home/sar/weblog/pyblosxom.cgi/

<Location /weblog>
...
mod_python config
...
</Location>


@FX
can you please answer will's call for version and environment infos


cheers
Steven


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642