Re: CGI source being exposed using "~"

[joe () BLARG NET (Joe)]

On Sun, 7 May 2000, Nathan Einwechter wrote:

> This problem allows anyone to view and download the source for any of the
> CGI scripts on their site. All that I did, was put a tild "~" at the end
> of the url to the cgi, and it popped up with the CGI source code, and some
> images etc, which the code references to within. None of it is formated
> when you first view it. However, if you just view the source of the page,
> right there infront of you, is the entire source code for the Perl CGI
> script.

[snip]

> This is obviously a problem, but why is it occuring? As far as I can tell,
> the server is running on Apache 1.3.9 (linux).

As everyone else has mentioned, it's just a backup file, however, it's a
symptom of a much more serious problem: Lack of basic unix security measures
by your administrator.

Nathan if the CGIs in that directory are owned by "root", then being able to
view them means the admin for that box is in desperate need of a
clue-by-four for not setting a more restrictive umask in their shell's
start-up scripts. (bashrc, tcshrc etc).  It means that every backup file
created by the various editors on the entire system is probably world
readable.

The default umask in most unmodified sh/bash shells is 002 (-rw-rw-r--). If
these are the permissions of the backup files you've found then your admin
has probably never even considered their default umask to be a problem.

Had they bothered to set a good umask in their start-up scripts, like 'umask
066', then the existance of those backup files would not be a real problem.

One caveat to all of this is emacs. The emacs editor ignores umask settings
and backup files created will mirror the permissions of the original file.

Let's hope your admin has never edited /etc/shadow.

--
Joe                                     Technical Support
General Support:  support () blarg net     Blarg! Online Services, Inc.
Voice:  425/401-9821 or 888/66-BLARG    http://www.blarg.net