Search code examples
securityunixcgicracking

Does a web cracker need reading perrmission to destroy a UNIX server

In UNIX, if I give a website member indirect permission to write to a file, read from the file, but through a cgi, what are the security risks?

like so:

schematic

As you can see, only the cgi has permission to read and write to the file. It would seem that this would prevent security problems.

OR AM I FOOLING MYSELF?

Edit:

here's how it works: 1. the user enters there info in a simple <form>. 2. the user sends the <form> to the cgi. 3. the cgi writes the <form> info to the file.

I guess my main worry is the user embedding destructive exes in the file. However they don't have DIRECT permission to r/w the file.

also... ... it is this and only this file that the user can indirectly write to

Solution

  • The security implications depend on what affect viewing/editing said file has. If the user is able to view /etc/shadow (which contains password hashes), then they would be able to attempt to bruteforce user passwords. If they are able to access any configuration files as well, it may expose login details and other sensitive information.

    If properly implemented, this system can be secure, but it would be fighting and uphill battle, and there are many other solutions that would probably suit your needs better.