Search code examples
perlsecuritycgiiptablestaint

How can I invoke /sbin/iptables from a Perl CGI under taint mode?

When I invoke "sudo /sbin/iptables ..." in my Perl CGI scripts, I get the error:

Insecure dependency in system while running with -T switch at usr/lib/perl5/vendor_perl/5.8.8/IPC/Run3.pm line 403

I tried to add "/sbin:/etc/sysconf:/etc/init.d" in $ENV{'PATH'} but still no success. Anybody has any idea?

Solution

  • You are supposed to restrict the path, meaning: setting it to a small number of known values that fulfill certain requirements (such as $ENV{PATH} = '/sbin:/usr/sbin:/usr/bin';), not adding to it. See Cleaning Up Your Path in perlsec for the details.

    In your simple case, it is best to clear it altogether and rely only on system calls with fully qualified file names.

    delete @ENV{qw(PATH ENV)};
system qw(/usr/bin/sudo /sbin/iptables -h);