ksh cgi security

gypsy_rabbi · 07-06-2005, 11:29 PM

I need a button on a web-page that will do the following:

Code:

# concatenate multiple pdf files into one:

cd /var/www/wherever
/usr/bin/gs -q -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=full.pdf 1.pdf 2.pdf 3.pdf

The filenames to be concatenated will be POSTed as parameters, and this is the only thing the button will ever do.

I'm wary of using CGI with a shell script. Is there any way to make this secure?

Thanks,

GR

nixcraft · 07-07-2005, 03:42 AM

Use perl insted of ksh/bash, as perl support more feature to check input (passed via args) since the filenames to be concatenated will be POSTed as parameters.

Krugger · 07-07-2005, 03:50 PM

But it is tricky

imagine a file name is inputed as ";rm -rf / "
or the ; as a hex or octal or unicode or unicode double encoded

wouldn't perhaps be easier to have the files indexed and shown?

So that you only process an number.

Krugger · 07-07-2005, 04:01 PM

the attacker won't destroy your system as you probably got apache as nobody, but still your files are gone and what ever nobody can delete will be deleted.

gypsy_rabbi · 07-08-2005, 02:42 PM

Krugger: yes, the files are indexed by date, and I'm checking to make sure that the input is a valid date. Is there anything else I should think about?

nixcraft: if you can figure out a way to call gs from perl, with parameters, and without using "system" calls, let me know.

Thanks.

Krugger · 07-09-2005, 02:40 PM

If you use number or such remember that the attacker can craft the GET or POST.

if you changed to php or something else beware of code injection, in shell script it is the same.

now that you are thinking about the ';', think about these:

$(ls -la)
' $(ls -la) '

This will be interpreted by the ksh and to do the substitution it will have to execute the command. Of course this might not work as I don't know how you are doing the verifications on the date.

Also beware of its size, although I don't think gs is vunerable to bufferoverflow.

Perl must have a pdf api. It has one for almost everything.