Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unix Wildcards Gone Wild

defensecode.com

Post reply on HN
Print view View original

51–54 of 54 posts

Re: Unix Wildcards Gone Wild

#51

Post by [deleted] »

jingo wrote: post #37
jingo wrote: post #19

echo rm * echo chown -R nobody:nobody *.php echo chmod 000 * echo tar cvvf archive.tar * echo tar cf archive.tar * echo rsync -t *.c foo:src This article starts with the premise that the person executing the command has no idea what files are in the current working directory. That is itself a more serious problem than the behaviour of wildcards. Later in the article we learn that it also assumes GNU utilities. That i…

I keep forgetting that GNU echo has an -e option, which, if I'm not mistaken, makes it behave like printf. (Why does it need this feature when there also exists a builtin printf? Nevermind.) Anyway, I didn't think about what happens if you create one file called "-e" and then do echo * Anyway, as someone else pointed out, using ./* instead of * will defeat the "exploits" in the article.

[deleted]

Re: Unix Wildcards Gone Wild

#52

Post by 6c6db4ab »

ninkendo wrote: post #28
Maken wrote: post #25

Earlier quoted context omitted.

Yes, because no user-uploaded filename will ever be parsed by a maintenance script in a server.

Not by any sane person, no. Why are you letting people upload and name their own files on your server? Should we be posting articles about the vulnerabilities in the finger daemon or Solaris 8's NIS implementation, while we're at it? It seems like this article is aiming towards shared servers where you actually allow shell login to "untrusted" users, which IMO is a relic of days long past, that only really persists a…

Lets say you have web server, this web server have web application that allows users to upload files. Web application is sane and doesn't allow path traversal and have proper .htaccess inside of the upload directory.

Now all you need is a user who kindly requests for a copy of uploaded files. If you're not aware of this issue (and you must be "actively aware" i.e. watch out for it all the time) you can do something that shouldn't be possible.

Re: Unix Wildcards Gone Wild

#53

Post by mzs »

emmelaich wrote: post #26

This is one of the reasons sudo should (by default) only allow a whitelist of built-in commands to be run with wildcards. Somewhat like sudoedit. This is of course for the corporate case of a less privileged user performing a certain task at elevated privileges. Not for the more common use of sudo (these days) of people managing their own personal machines.

It's the shell that expands the wildcards which are passed to sudo as arguments.

Re: Unix Wildcards Gone Wild

#54

Post by ninkendo »

6c6db4ab wrote: post #52
ninkendo wrote: post #28

Earlier quoted context omitted.

Not by any sane person, no. Why are you letting people upload and name their own files on your server? Should we be posting articles about the vulnerabilities in the finger daemon or Solaris 8's NIS implementation, while we're at it? It seems like this article is aiming towards shared servers where you actually allow shell login to "untrusted" users, which IMO is a relic of days long past, that only really persists a…

Lets say you have web server, this web server have web application that allows users to upload files. Web application is sane and doesn't allow path traversal and have proper .htaccess inside of the upload directory. Now all you need is a user who kindly requests for a copy of uploaded files. If you're not aware of this issue (and you must be "actively aware" i.e. watch out for it all the time) you can do something t…

I'm a bit late replying, but I wouldn't consider an application that allows users to upload files, and pick their names to be a sane application. Do you think imgur (as an example) lets users name their files? What about stuff like the defunct megaupload or other file sharing sites? You get to pick filenames but that's really metadata... the URLs and (presumably) the underlying file storage structure are database-driven.
Post reply on HN