Topic: Security issue with Windows2k and CGI

[rethaew]

Good Day. I have recently been put in charge of managing a web server and I am not very familiar with Apache, or web servers in general, so please forgive my ignorance.

The server has Windows2k, Apache 2.2 and Activeperl 5.8. The problem is that there does not seem to be any security with the perl. Any web site that has CGI enabled can run a perl script that will execute system commands, modify files, etc. ANYWHERE on the server, not just in the home directory for that site. This is a gaping security hole that needs to be fixed. So if a user wanted to do some damage, he could in theory delete all other web site folders, destroy some system files, etc. Very bad.

I have searched the web and forums for a solution but this major issues doesn't seem to be addressed much. Can anyone advise on how to limit CGI activity to a web site's home directy with this setup.

Thanks.

Tim

[Jcink]

For windows, I dont believe there is a solution. Unlike PHP, which has open-basedir restriction I don't think CGI has anything like that. You need to be able to set permissions and stuff, and chroot, there isn't any of that on windows.

[James Blond]

You can secure it by the User. You can create a new user, that only can access the webfolders. Put that user to the cgi handler (*.exe) and remove all other users.

It is like this topic
http://www.apachelounge.com/viewtopic.php?t=460

[rethaew]

Thanks for your suggestions. Can you give further explanation for where you say:

"Put that user to the cgi handler (*.exe) and remove all other users."

I am not sure of where or how this is done.

Thanks
Tim

[James Blond]

I think you are using Windows XP or 2000(?)

e.g.

• search for the perl.exe you use as the cgi handler.
  
• Right Click => Properties => Security
  
• Add the new user with the lower permissions
  
• remove all other user (maybe the SYSTEM user must left, not sure)
  
• Choose the new user
  
• Use the Checkboxes below to choose what the user will be allowed
  

I think you should use guest or normal user for the new user account.

[YoDude9999]

In the httpd.conf file, you set access options. Here's mine: