Received: (qmail 2712 invoked by uid 2012); 12 Oct 1998 06:42:11 -0000
Message-Id: <19981012064211.2711.qmail@hyperreal.org>
Date: 12 Oct 1998 06:42:11 -0000
From: Alex Tutubalin <lexa@lexa.ru>
Reply-To: lexa@lexa.ru
To: apbugs@hyperreal.org
Subject: <!--#exec cmd="/path/cmd" is not a subject of any restrictions (<Directory> etc)
X-Send-Pr-Version: 3.2

>Number:         3184
>Category:       mod_include
>Synopsis:       <!--#exec cmd="/path/cmd" is not a subject of any restrictions (<Directory> etc)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          closed
>Class:          change-request
>Submitter-Id:   apache
>Arrival-Date:   Sun Oct 11 23:50:00 PDT 1998
>Last-Modified:  Mon Oct 12 12:30:00 PDT 1998
>Originator:     lexa@lexa.ru
>Organization:
>Release:        1.3.3
>Environment:
FreeBSD 2.2.7 w/ gcc 2.7.2.1, but problem avaliable on all Unix machines
>Description:
There is no way to open access for #include virtual or #exec cgi
without giving access to #exec cmd command _without_ any restrictions.

I'm running Apache with many virtual hosts, managed by different peoples.
I want to give access to #include several audited scripts (such as banner systems,
generic footers etc) into user HTML files. Such scripts should resides in
directory, writable only by auditing team.

Unfortunately, with '#exec cmd' user can run _any_ code on my machine if he
can upload files into his home directory, change mode to 0755 and
can guess real path to these files (from httpd's point of view). It is possible
to run any local exploit, mass spam-sending programs and so on.

All other SSI features are not subject of this problem - I can enable Options 
Includes for  user's directory, but enable ExecCGI only for tested scripts.
>How-To-Repeat:

>Fix:
There is several ways:
1) Optimal - put #exec cmd into same restrictions as other CGI calls -
options ExecCGI should be on
2) Palliative - virtual server or directory-wide directive for disabling/
enabling #exec cmd feature
>Audit-Trail:
State-Changed-From-To: open-closed
State-Changed-By: marc
State-Changed-When: Sun Oct 11 23:52:18 PDT 1998
State-Changed-Why:
If you don't want people to be able to execute things
from SSIs, use "Options IncludesNoEXEC".  They can still
use include virtual to execute CGIs from ScriptAliased
directories since htat isn't really calling a CGI, but 
just calling an arbitrary document that already is treated
as a CGI

From: Alex Tutubalin <lexa@lexa.ru>
To: marc@apache.org
Cc: apbugs@apache.org
Subject: Re: mod_include/3184: <!--#exec cmd="/path/cmd" is not a subject of any restrictions (<Directory> etc)
Date: Mon, 12 Oct 1998 23:20:53 +0400

 >If you don't want people to be able to execute things
 >from SSIs, use "Options IncludesNoEXEC".  They can still
 >use include virtual to execute CGIs from ScriptAliased
 >directories since htat isn't really calling a CGI, but
 >just calling an arbitrary document that already is treated
 >as a CGI
 
 Unfortunately, this method brokes MultiViews for included files.
 I've some /cgi-bin/test.ru (and ru is default language for my servers).
 With Options +Includes +MultiViews for .shtml file and Options +MultiViews
 for (scriptaliased) /cgi-bin/ both include virtual and exec cgi 
 for "/cgi-bin/test" are calls /cgi-bin/test.ru as expected.
 
 With Options IncludesNOEXEC language negotiation mechanics is broken -
 I need to point to exact "/cgi-bin/test.ru" script in html code.
 
 Of course, it is not a mod_include problem. I'll try to distinguish
 the exact source and will write another bug submission if it is not my
 fault.
 
 Alex Tutubalin
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <apbugs@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request ]
[from a developer.                                      ]
[Reply only with text; DO NOT SEND ATTACHMENTS!         ]