Hacker News Reader

Comment by simonw | Hacker News Reader

What makes it insecure? It's a pretty simple protocol - anything in there that makes is insecure beyond naive mistakes that could be avoided with a well designed library?

EDIT: Looks like the way CGI works made it vulnerable to Shellshock in 2014: https://en.m.wikipedia.org/wiki/Shellshock_(software_bug)

I agree that there's probably not much of an argument to switch to it from the well established alternative mechanisms we are using already.

The one thing in its favor is that it makes it easier to have a polyglot web app, with different languages used for different paths. You can get the same thing using a proxy server though.

View on HN

CGI has a very long history of security issues stemming primarily from input validation or the lack thereof.

Right, but anything relating to input validation can be avoided by using a well designed library rather than implementing the protocol directly.

The language in use often has input validation libraries. The failure of the programmer to use them is not the fault of CGI. Further, proper administration of the machine can mitigate file injection, database injection, etc. Again, that people fail to do this isn’t the fault of CGI.

That's like saying forks and knives are vulnerable becuase you could stab someone with them.

> CGI has a very long history of security issues stemming primarily from input validation or the lack thereof.

And a Go program reading from a network connection is immune from the same concerns how?

It's not, you have to use Rust :)

> It's not, you have to use Rust :)

If only I could borrow such confidence in network data... :-D

>EDIT: Looks like the way CGI works made it vulnerable to Shellshock in 2014:

From your linked article: If the handler is a Bash script, or if it executes Bash...

But we are talking about Python not Bash.

Yes, Shellshock is kind of a marginal case, but it probably does qualify as a security hole due in part to CGI itself, even though it doesn't affect Python programs (unless they spawn a shell). I don't know of any other examples of security problems caused by CGI, even partly. It's a very thin layer over HTTP.

IIRC the main issue was finding ways to convince a CGI script to write something to disk, at which point you could sometimes make it be treated as another CGI script. More of an issue on Windows than UNIX.

Because... it can execute an arbitrary executable? In the old days, it also ran as root.

No, on all the servers I have any experience with, it can only execute executables the server administrator configures as CGI programs, not executables supplied by an attacker, and they never ran as root. Apache in particular is universally run as a non-root user, since the very first release, and its suEXEC mechanism (used for running CGI programs as their owners for shared web hosting services) refuses to run any CGI program as root. I've never seen a web server on a Unix system running as root: not CERN httpd, not NCSA httpd, not Apache, not nginx, not python -m http.server, not any of the various web servers I've written myself.

I hesitate to suggest that you might be misremembering things that happened 30 years ago, but possibly you were using a very nonstandard setup?

BusyBox runs as root by default, and it's used by hundreds of millions of devices.

For embedded devices (routers, security cameras, etc), it's very common to run CGI scripts as root.

So it is not even 30 years ago, it's still today, because of bad practices of the past.

Oh, that's a good point. In those cases the web server actually needs root, in the sense that it has to be able to upgrade the firmware and reconfigure the network interface.

It definitely can’t. Either you had to put your script in cgi-bin, use an extension like .cgi in a directory with that feature explicitly enabled, or a magic sticky bit on the file if that was enabled.

You could configure the server to be insecure by, eg, allowing cgi execution from a directory where uploaded files are stored.

Reply on news.ycombinator.com