Re: [Fwd: pWins Perl Web Server Directory Transversal Vulnerability]

Gunter,

On Friday, November 29, 2002, at 02:19 AM, Gunther Birznieks wrote:

>  Speaking of Perl Web Server vulnerabilities....
[snip]
> pWins allows directory transversal via unicode characters (%255, you=20=

> know, nimda stuff).. If it's installed on the c drive, you can get to=20=

> any file (ahem.. sam._) easily.. for example,=20
> http://SomeWebServer/../../windows/repair/sam._
>
> no exploit provided because too trivial..


Hah! I checked the source of this thing, this guy takes security very=20
seriously:


> # Bei dieser Funktion handelt es sich um den eigentlichen=20
> Sicherheitscheck von
> # pWins bei Perlscripten. Sie parst den Sourcecode vor der =
verarbeitung=20
> nach
> # Befehlen, die nicht vorkommen d=B8rfen weil sie die Serversicherheit=20=

> gef=89hrden
> # w=B8rden.
>
> # Derzeit handelt es sich hierbei nur um einen Test
>
> sub Parse {
>
> 	$cgi_bin =3D $_[1];
>
> 	$file =3D substr($_[2], 1, (length($_[2])-1));
>
> 	open(SCRIPT, "$cgi_bin"."$file");
>
> 	while(<SCRIPT>){
>
> 		chomp;
>
> 		my @type =3D split(/\n/);
>
> 		foreach my $line (@type){
>
> 			unless($line =3D~ /^#/){
>
> 				if($line eq /system/){
>
> 					my $securecounter =3D 1;
>
> 				}
>
> 			}
>
> 		}
>
> 	}
>
> 	close(SCRIPT);
>
>
>
> 	if($securecounter !=3D 0){return(1)};
>
>
>
> 	return(0);
>
> }

See? Whenever the server receives a request to run a perl cgi script, it=20=

parses it and refuses to run it if the word "system" occurs in it! Even=20=

in a comment whose '#' has whitespace in front of it!

Who said parsing perl was hard?

Regards,

Bas.

ps. I wonder if we could make a really good perl application server=20
based on this?