Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of trawick@gmail.com designates
 209.85.217.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <7D9F127E-5D38-4190-80A7-58BFDC55E051@uvm.edu>
References: <7D9F127E-5D38-4190-80A7-58BFDC55E051@uvm.edu>
Date: Fri, 20 Sep 2013 16:33:05 -0400
Message-ID: 
 <CAKUrXK7ZBGQ4eXVzyYsbzTBBbdhA7ZWzN2PANnrLoRmd2OfWEw@mail.gmail.com>
Subject: Re: [PATCH 49220] mod_fcgid - restrict arbitrary command execution
 from .htaccess files
From: Jeff Trawick <trawick@gmail.com>
To: Apache HTTP Server Development List <dev@httpd.apache.org>
Content-Type: multipart/alternative; boundary=001a11c3675ee5161a04e6d693ba

--001a11c3675ee5161a04e6d693ba
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Sep 20, 2013 at 4:31 PM, Benjamin Coddington <bcodding@uvm.edu>wrote:

> Hello everyone,
>
> We're looking at moving our shared hosting execution behind mod_fcgid and
> suexec, but we need to continue to allow our users .htaccess 'Files'
> overrides.  The current mod_fcgid allows users to execute arbitrary
> commands by configuring the FcgidAccessChecker, FcgidAuthenticator,
> FcgidAuthorizer, and FcgidWrapper directives within .htaccess files.
>
>  - https://issues.apache.org/bugzilla/show_bug.cgi?id=49220
>
> I've approached a fix by creating a directive that would disable the
> application of those directives within .htaccess files if set; that patch
> has been submitted to the httpd bug 49220.
>
> You might shrewdly wonder "how can this matter - this is cgi after all,
> we're just going to try to exec the resulting file!", but we're able to get
> away from that by disabling ExecCGI globally and setting it per-request in
> separate module which also ensures the request is mapped to our specific
> FcgidWrapper.
>
> I see mod_fcgid 2.3.8 is closing in a few days; any chance to sneak this
> in?  Thanks for your time and consideration.
>
> Ben


Unless someone else speaks up, I'll spend some time on it.


-- 
Born in Roswell... married an alien...
http://emptyhammock.com/

--001a11c3675ee5161a04e6d693ba
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">On Fri, Sep 20, 2013 at 4:31 PM, Benjamin Coddington <span=
 dir=3D"ltr">&lt;<a href=3D"mailto:bcodding@uvm.edu" target=3D"_blank">bcod=
ding@uvm.edu</a>&gt;</span> wrote:<br><div class=3D"gmail_extra"><div class=
=3D"gmail_quote">
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">Hello everyone,<br>
<br>
We&#39;re looking at moving our shared hosting execution behind mod_fcgid a=
nd suexec, but we need to continue to allow our users .htaccess &#39;Files&=
#39; overrides. =A0The current mod_fcgid allows users to execute arbitrary =
commands by configuring the FcgidAccessChecker, FcgidAuthenticator, FcgidAu=
thorizer, and FcgidWrapper directives within .htaccess files.<br>

<br>
=A0- <a href=3D"https://issues.apache.org/bugzilla/show_bug.cgi?id=3D49220"=
 target=3D"_blank">https://issues.apache.org/bugzilla/show_bug.cgi?id=3D492=
20</a><br>
<br>
I&#39;ve approached a fix by creating a directive that would disable the ap=
plication of those directives within .htaccess files if set; that patch has=
 been submitted to the httpd bug 49220.<br>
<br>
You might shrewdly wonder &quot;how can this matter - this is cgi after all=
, we&#39;re just going to try to exec the resulting file!&quot;, but we&#39=
;re able to get away from that by disabling ExecCGI globally and setting it=
 per-request in separate module which also ensures the request is mapped to=
 our specific FcgidWrapper.<br>

<br>
I see mod_fcgid 2.3.8 is closing in a few days; any chance to sneak this in=
? =A0Thanks for your time and consideration.<br>
<br>
Ben</blockquote></div><br>Unless someone else speaks up, I&#39;ll spend som=
e time on it.<br><br clear=3D"all"><div><br></div>-- <br>Born in Roswell...=
 married an alien...<br><a href=3D"http://emptyhammock.com/" target=3D"_bla=
nk">http://emptyhammock.com/</a><br>

</div></div>

--001a11c3675ee5161a04e6d693ba--