The problem with the script mentioned above is the single line that executes the finger command:

print `/usr/bin/finger $input{'command'}`;

This line executes the program /usr/bin/finger with the input provided and displays the result. The problem with this line is the way in which the finger command is invoked—from Perl’s backquote function. The backquote function provides its input to the UNIX shell—and the UNIX shell may interpret some of that input in an unwanted manner!

Thus, when we sent the value [email protected] to this CGI script, it ran the UNIX command:

print `/usr/bin/finger [email protected]`;

and that evaluated to:

/usr/bin/finger [email protected]

and that then produced the expected result.

The UNIX shell is known and admired for its power and flexibility by programmers and malicious hackers alike. One of these interesting abilities of the UNIX shell is the ability to put multiple commands on a single line. For example, if we wanted to run the finger command in the background and, while we are waiting,^[86] do an ls command on the current directory, we might execute this command:

/usr/bin/finger [email protected] & /bin/ls -l

And indeed, if we type in the name [email protected] & /bin/ls -l as our finger request (see Figure 15.3), the bad_finger script will happily execute it, which produces the output (see Figure 15.4).

Figure 15-3. Executing the bad_finger script

Figure 15-4. Output from the bad_finger script

What’s the harm in allowing a user to list the files? By looking at the files, an attacker might learn about other confidential information stored on the web server. Also, the /bin/ls command is simply one of many commands that the attacker might run. The attacker could as easily run commands to delete files or to open up connections to other computers on your network, or even to crash your machine.

Although most operating systems are not fundamentally unsecure, few operational computers are administered in such a way that they can withstand an inside attack from a determined attacker. Thus, you want to ensure that attackers never get inside your system. To prevent an attacker from gaining that foothold, you must be sure that your CGI scripts cannot be turned against you.

Fixing the problem with the bad_finger script is remarkably easy. All you need to do is not trust the user’s input. Instead of merely sending $input{`command'} to a shell, you should filter the input, extracting out legal characters for the command that you wish to execute.

In the case of finger, there is a very small set of characters that are valid in email addresses or hostnames. The script below selects those characters with a regular expression pattern match:

if(&ReadForm(*input)){
    $input{'command'} =~ m/([[email protected]]*)/i;		# Match alphanumerics, @ and -
    print "<pre>
";
    print `/usr/bin/finger $1`;
    print "<pre>
";
}

This command works as before, except that it won’t pass on characters such as “&” or “;” or " ` " to the subshell.

Notice that this example matches legal characters, rather than filtering out disallowed ones. This is an important distinction! Many publications recommend filtering out special characters—and then they don’t tell you all of the characters that you need to remove. Indeed, it’s sometime difficult to know, because the list of which characters to remove depends on how you employ the user input as well as which shells and programs are invoked. For example, in some cases you might wish to allow the characters “.” and “/”. In other cases you might not, because you might not want to let the user specify the pathname .. /.. /.. /.. /.. /etc /passwd. That’s why best practice recommends selecting which characters to let through, rather than guessing which characters should be filtered out.^[87]

The script can be made more secure (and faster) by using Perl’s system function to run the finger command directly. This entirely avoids calling the shell:

if(&ReadForm(*input)){
    $input{'command'} =~ m/([w+@-]*)/i;		# Match alphanumerics, @ and -
    print "<pre>
";
    system '/usr/bin/finger', $1;
    print "<pre>
";
}

The next section gives many “rules of thumb” that will help you to avoid these kinds of problems in your CGI and API programs.