#7 run.cgi problem

closed
Jamie Cameron
5
2002-08-03
2002-08-02
Anonymous
No

we use Webmin to allow a user to manage his print queue
passing the name of the printer to the form.
We saw that it's possible to run arbitrary code on the
machine where webmin is installed adding a ';command'
to the printer name
es.

printer name=b000
string passed=b000';cat /etc/passwd'

will show the contents of the passwd file and then show
the status of the printer b000.

the batch file that run.cgi create in /tmp is:

#!/bin/sh
prn='b000';cat /etc/passwd''
export prn
/usr/local/webmin_scripts/lpc_view.sh "$prn"

when the batch file is executed the value b000 is
assigned to the variable prn an then the command cat
/etc/passwd is executed.

I hope this informations can help you to solve the problem.

Kind regards

Enrico Mignani (enrico.mignani@it.abb.com)

Discussion

  • Jamie Cameron
    Jamie Cameron
    2002-08-03

    • status: open --> closed
     
  • Jamie Cameron
    Jamie Cameron
    2002-08-03

    Logged In: YES
    user_id=129364

    Damn, you're right .. this is a serious bug.
    I have released an update for it, which is now available at
    http://www.webmin.com/updates.html