the-web-application-hackers-handbook

358 Chapter 10 n Attacking Back-End Components
Injecting OS Commands
Most web server platforms have evolved to the point where built-in APIs exist
to perform practically any required interaction with the server’s operating
system. Properly used, these APIs can enable developers to access the filesystem,
interface with other processes, and carry out network communications in
a safe manner. Nevertheless, there are many situations in which developers
elect to use the more heavyweight technique of issuing operating system commands
directly to the server. This option can be attractive because of its power
and simplicity and often provides an immediate and functional solution to
a particular problem. However, if the application passes user-supplied input
to operating system commands, it may be vulnerable to command injection,
enabling an attacker to submit crafted input that modifies the commands that
the developers intended to perform.
The functions commonly used to issue operating system commands, such
as exec in PHP and wscript.shell in ASP, do not impose any restrictions on
the scope of commands that may be performed. Even if a developer intends
to use an API to perform a relatively benign task such as listing a directory’s
contents, an attacker may be able to subvert it to write arbitrary files or launch
other programs. Any injected commands usually run in the security context
of the web server process, which often is sufficiently powerful for an attacker
to compromise the entire server.
Command injection flaws of this kind have arisen in numerous off-the-shelf
and custom-built web applications. They have been particularly prevalent within
applications that provide an administrative interface to an enterprise server or
to devices such as firewalls, printers, and routers. These applications often have
particular requirements for operating system interaction that lead developers
to use direct commands that incorporate user-supplied data.
Example 1: Injecting Via Perl
Consider the following Perl CGI code, which is part of a web application for
server administration. This function allows administrators to specify a directory
on the server and view a summary of its disk usage:
#!/usr/bin/perl
use strict;
use CGI qw(:standard escapeHTML);
print header, start_html(“”);
print “”;
my $command = “du -h --exclude php* /var/www/html”;
$command= $command.param(“dir”);
$command=`$command`;