1418
The following code segment implements a basic server that uses the "ls" program to perform a
directory listing of the directory that is listed in the "HOMEDIR" environment variable. The code
intends to allow the user to specify an alternate "LANG" environment variable. This causes "ls" to
customize its output based on a given language, which is an important capability when supporting
internationalization.
Example Language: Perl (Bad)
$ENV{"HOMEDIR"} = "/home/mydir/public/";
my $stream = AcceptUntrustedInputStream();
while (<$stream>) {
chomp;
if (/^ENV ([\w\_]+) (.*)/) {
$ENV{$1} = $2;
}
elsif (/^QUIT/) { ... }
elsif (/^LIST/) {
open($fh, "/bin/ls -l $ENV{HOMEDIR}|");
while (<$fh>) {
SendOutput($stream, "FILEINFO: $_");
}
close($fh);
}
}
The programmer takes care to call a specific "ls" program and sets the HOMEDIR to a fixed value.
However, an attacker can use a command such as "ENV HOMEDIR /secret/directory" to specify
an alternate directory, enabling a path traversal attack (CWE-22). At the same time, other attacks
are enabled as well, such as OS command injection (CWE-78) by setting HOMEDIR to a value
such as "/tmp; rm -rf /". In this case, the programmer never intends for HOMEDIR to be modified,
so input validation for HOMEDIR is not the solution. A partial solution would be an allowlist that
only allows the LANG variable to be specified in the ENV command. Alternately, assuming this is
an authenticated user, the language could be stored in a local file so that no ENV command at all
would be needed.
While this example may not appear realistic, this type of problem shows up in code fairly frequently.
See CVE-1999-0073 in the observed examples for a real-world example with similar behaviors.
Observed Examples
Reference Description
CVE-2005-2428 Mail client stores password hashes for unrelated accounts in a hidden form
field.
https://www.cve.org/CVERecord?id=CVE-2005-2428
CVE-2008-0306 Privileged program trusts user-specified environment variable to modify critical
configuration settings.
https://www.cve.org/CVERecord?id=CVE-2008-0306
CVE-1999-0073 Telnet daemon allows remote clients to specify critical environment variables
for the server, leading to code execution.
https://www.cve.org/CVERecord?id=CVE-1999-0073
CVE-2007-4432 Untrusted search path vulnerability through modified LD_LIBRARY_PATH
environment variable.
https://www.cve.org/CVERecord?id=CVE-2007-4432
CVE-2006-7191 Untrusted search path vulnerability through modified LD_LIBRARY_PATH
environment variable.
https://www.cve.org/CVERecord?id=CVE-2006-7191
CVE-2008-5738 Calendar application allows bypass of authentication by setting a certain
cookie value to 1.
https://www.cve.org/CVERecord?id=CVE-2008-5738
CVE-2008-5642 Setting of a language preference in a cookie enables path traversal attack.
CWE Version 4.14
CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
CWE-643: Improper Neutralization of Data
within XPath Expressions ('XPath Injection')