[24178] in bugtraq
Re: new advisory - (filtering problems)
daemon@ATHENA.MIT.EDU (b0iler _)
Thu Feb 7 17:29:43 2002
From: "b0iler _" <b0iler@hotmail.com>
To: andrew@zpok.demon.co.uk
Cc: bugtraq@securityfocus.com
Date: Wed, 06 Feb 2002 19:36:47 -0700
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <F49BPcYHfQJcsOgnju80001222b@hotmail.com>
>sj@datanet.hu wrote:
>>I think some filtering after the line '$q = new CGI;' would help a little
>>
>>Eg.
>>
>>my $SECMSG = 'Pliz dont hekk us\n";
>>
>>if(!defined $q->param('cfg')){ die "missing cfg file\n"; }
>>my $xx = $q->param('cfg');
>>
>>if($xx =~ /\.\.|\/\/|\.\//){ die $SECMSG; }
>Eek! leaning toothpick syndrome!
>
> if ($xx =~ m"\.\. | # if match '..' anywhere, or
> // | # match '//' anywhere, or
> \./ "x) { # match './' anywhere:
> die $SECMSG;
> }
>
>Of course, as a general rule, it's better to take a leaf out of the
>firewall admin's book: deny everything by default, then allow only
>specific, known good patterns. For example, isn't this code prone to
>fragility in the presence of hex-encoded characters?
Yes, great advice. also watch out for flying \'s. Even though you are
filtering which is good, one mistake can make your perl dirty and of little
worth. Setting $q->param('cfg') to .\.\/ will make it past these filters and
hekk you. A nice way of filtering is to filter out meta characters first,
then the double dot, or the best method - "deny everything by default".
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.
