HTTP CGI Access

Impact

Local and remote users may be able to execute arbitrary commands on the HTTP server with the privileges of the httpd daemon. This may be used to compromise the HTTP server and, under certain configurations, gain privileged access.

Background

webdist:
A security vulnerability has been reported in the webdist.cgi cgi-bin program available with IRIX 5.x and 6.x. webdist.cgi is part of the IRIX Mindshare Out Box software package, which allows users to install software over a network via a World Wide Web interface. webdist.cgi allows webdist(1) to be used via an HTML form interface defined in the file webdist.html, which is installed in the default document root directories for both the Netsite and Out Box servers. Due to insufficient checking of the arguments passed to webdist.cgi, it may be possible to execute arbitrary commands with the privileges of the httpd daemon. This is done via the webdist program. When installed, webdist.cgi is accessible by anyone who can connect to the httpd daemon. Because of this, the vulnerability may be exploited by remote users as well as local users. Even if a site's webserver is behind a firewall, it may still be vulnerable.

phf:
The phf cgi  program comes with the NCSA version 1.5 and Apache 1.03 web servers.  There may be other distributions that also have the phf cgi program in the cgi-bin directory.  The program relies on the escape_shell_cmd() function,  which can allow execution of system commands (ex: cat /etc/password).  Therefore, if a malicious user determines that the phf cgi is present on the system, they can execute commands which have the same privilege as the web server.

campas:
The campas cgi program is installed with older versions of the NCSA web server.  A malicious user may be able to execute commands with the same privilege of the web server running.

handler:
The handler cgi is part of the Outbox Environment subsystem on IRIX 5.x and 6.x systems.  The cgi can be manipulated to execute commands at the privilege level of the web server.
Check to see if the Outbox system is on the system:

   % /usr/sbin/versions outbox.sw

   I = Installed, R = Removed

      Name                 Date      Description

   I  outbox               03/23/97  Outbox Environment, 1.2
   I  outbox.sw            03/23/97  Outbox End-User Software, 1.2
   I  outbox.sw.outbox     03/23/97  Outbox Software Tools, 1.2
   I  outbox.sw.webdist    03/23/97  Web Software Distribution Tools, 1.2

htmlscript:
htmlscript  "is an HTML based web development language which provides the power of scripting via new, easy-to-use tag," according to BugTraq.  The htmlscript, from www.htmlscript.com, has a vulnerability which allows a malicious user to access files.  The vulnerability exists in 2.99x according to htmlscript.  Version 3.x/Miva 1.x does not contain the vulnerability.

php:
The php is a NCSA cgi enhancement.  The cgi has a vulnerability that lets unauthorized users view file on the system.  The cgi works by sending the path to the file as an argument to the cgi

http://hostname/cgi-bin/php.cgi?/look-at-this-file

The php.cgi will let the malicious user view any file that the web server has privilege to read.

count:
The count program is used to count the number of times a particular web page has been accessed. In the program there is "...insufficient bounds checking on arguments which are supplied by users.."  There is a possibility of overwrite the stack space and execute commands.  A malicious user can create a specific argument to the count.cgi and force it to execute commands with the permission of the web server privileges.

jj:
jj is a demo cgi program.  It does not check user input to the /bin/mail program.  Therefore, a malicious your can have themselves sent the any output they wish to view.  For example, if the web server is running as root, they may mail themselves the password file.

pfdispaly:
The pfdispaly (sic) cgi is part of the IRIS Performer API Search Tool which is a web based search tool that comes with the IRIX 6.2-6.4 operating system.  The vulnerability could allow access to files with the privileges of the user "nobody."

faxsurvey:
The faxsurvey could allow a malicious user to execute any command they want at the privilege level of the http server.  The cgi is part of the HylaFAX package that can with S.u.S.E. 5.1 & 5.2.  Older versions may also be vulnerable.

info2www:
The info2www cgi translates the Info Nodes that a user can view in Emacs, to HTML on the fly.  The script is written in perl and can allow a malicious user to execute system commands at the privilege level of the web server.  Not all of the versions of info2www are considered vulnerable.  The way to determine if you have a vulnerable script is to see if it at least has a version number and is greater than version 1.1.  If it does not have a version number, then it is most likely vulnerable and if it is version 1.1, it is also vulnerable.

textcounter:
textcounter is a perl script that displays a text based number which is the number of visitors to the web page.  The counter  needs to read, write, and create a file to store the number of visitors.  The vulnerability comes from a lack of a test for shell metacharacters.  A malicious user may be able to have perl execute commands at the web server privilege.  Check out BugTraq to see more information on the vulnerability.

aglimpse/glimpse:
Glimpse is a search and indexing tool.  aglimpse/glimpse is an interface to the Glimpse search tool.  The cgi is written in perl. The vulnerability can allow access to the password by mailing a malicious user the password file.

WebGais & websendmail:
WebGAIS is an interface to the Global Area Intelligent Search (GAIS) index/search tool.  The cgi can be tricked to execute system commands with the privilege of the web server.  The websendmail is a cgi that comes with the WebGAIS package.  websendmail can be tricked to send the password file to a malicious user because there is no check on what type of characters are sent to the perl cgi.  Therefore, a given a certain set of metacharacters, a malicious user may be able to have the cgi execute system commands with the privilege of the web server.

perl/perl.exe:
Perl is an interpreted scripting language.  To execute the perl script, the interpreter is used and the script is executed.  However, the interpreter should not be in the cgi-bin directory of the web server.  If there is a perl interpreter or a link to the interpreter, then a malicious user can do everything the normal perl interpreter can do from the command line.

Some very good rules to live by that have been found on the web:

  1. Never place any of your perl.exe files into your www-server directory
  2. Never call any perl script via this command line perl.exe?tscript.pl
  3. Never place perl anywhere on your system, reference it with the registry (for Windows Systems)
  4. Never associate any *.pl file with your perl executable, so that double clicking on any perl script will execute it immediately
  5. Never place any perl.exe into your cgi folders
www-sql:
The www-sql cgi is designed to access a mysql database through a http server and create a nice query result page.  Put simple, it generates HTML pages dynamically from the output of the SQL server, the database.  The problem that occurs is that www-sql overrides .htaccess restrictions.
.htaccess is a file that puts restrictions on directories for Apache and NCSA based web servers.  You can read more about the problem at BugTraq.

view_source:
The cgi comes on the SCO Skunkware cdroms.  The cgi is to display documents, however, it does not check the arguments correctly and therefore can show files with the privilege of the web server.
 

Resolution

webdist:
Vendor patches to protect against this vulnerability are available from Silicon Graphics Inc., and they should be applied as soon as possible. A workaround to this problem is to immediately remove the execute permissions on the webdist.cgi program to prevent its exploitation. If the Webdist software is not required, it should be removed from the system entirely. You may read more about this vulnerability in CERT Advisory 97.12.

phf:
It is recommend that you remove the cgi from the cgi-bin directory.  The program is not required to run the web server.

campas:
It is recommend that you remove the cgi from the cgi-bin directory.  The program is not required to run the web server.

handler:
There are patches available from SGI FTP site.
You may also remove the Outbox subsystem if there is no need for it being installed.

You may read more about the vulnerability in CERT Advisory 97.07.

htmlscript:
Upgrade to the newest version which can be found at the htmlscript.com website.

php:
The author has the following solution, in the php.h file add the line:

#define PATTERN_RESTRICT ".*\\phtml$"

that will restrict the php.cgi to viewing files with phtml as the extension.  The current version can be found http://www.vex.net/php.  For more details, see here.

count:
It is recommended to upgrade to the latest version. An alternative to upgrading is to remove the execute permissions from the cgi, however, this will cause the counter on the web page not to work correctly.  The rest of the web page should continue to look the same.  For more details, see the CERT advisory. The version to at least upgrade to is 2.4.

jj:
Since the program is a demo, it is recommend that it be removed from the cgi-bin directory.

pfdispaly:
Change the permissions of the cgi:  /bin/chmod 500 /var/www/cgi-bin/pfdispaly.cgi
The permission should be -r-x------BugTraq has information about the pfdispaly vulnerability.

faxsurvey:
There have been a variety of attempts made to fix the code in faxsurvey.cgi.  However, the best thing to do is remove it from the cgi-bin directory if there is no need for the cgi.

info2www:
It is recommended that the script is updated to the latest, version 1.2. You can read about the vulnerability at BugTraq.

textcounter:
To fix the vulnerability add the line after line 91 (taken from BugTraq):

$count_page = "$ENV{'DOCUMENT_URI'}";         # the original 91 line ....
$count_page =~ s/([^a-z0-9])/sprintf("%%%02X",$1)/ge;   # ADD THIS !!!!!

aglimpse/glimpse:
GlimpseHTTP is no longer available for updating, however, there is a new Glimpse interface called
WebGlimpse. It is recommended that the system be updated with WebGlimpse.

webgais & websendmail:
The best thing to do is upgrade to the latest version of the WebGAIS package.  After getting the latest version, disable the websendmail cgi that is included in the package.

perl/perl.exe:
Remove the links and binaries of the perl interpreter from the cgi-bin directory.

www-sql:
It is recommended that the script is updated to the latest version.

view_source:
According to BugTraq it is best to remove the cgi.
 

Whether any machines on your network are susceptible to this vulnerability or not, you should consider taking this opportunity to examine your entire httpd configuration schemes. In particular, all CGI programs that are not required should be removed, and all those remaining should be examined for possible security vulnerabilities. It is also important to ensure that all child processes of httpd are running as a non privileged user. This is often a configurable option. See the documentation for your httpd distribution for more details.

Where can I read more about this?

For those interested in reading more about general WWW security and secure CGI programming, visit the World Wide Web Security FAQ.