Hacker News Reader

Comment by slashdave | Hacker News Reader

Because... it can execute an arbitrary executable? In the old days, it also ran as root.

It definitely can’t. Either you had to put your script in cgi-bin, use an extension like .cgi in a directory with that feature explicitly enabled, or a magic sticky bit on the file if that was enabled.

You could configure the server to be insecure by, eg, allowing cgi execution from a directory where uploaded files are stored.

No, on all the servers I have any experience with, it can only execute executables the server administrator configures as CGI programs, not executables supplied by an attacker, and they never ran as root. Apache in particular is universally run as a non-root user, since the very first release, and its suEXEC mechanism (used for running CGI programs as their owners for shared web hosting services) refuses to run any CGI program as root. I've never seen a web server on a Unix system running as root: not CERN httpd, not NCSA httpd, not Apache, not nginx, not python -m http.server, not any of the various web servers I've written myself.

I hesitate to suggest that you might be misremembering things that happened 30 years ago, but possibly you were using a very nonstandard setup?

BusyBox runs as root by default, and it's used by hundreds of millions of devices.

For embedded devices (routers, security cameras, etc), it's very common to run CGI scripts as root.

So it is not even 30 years ago, it's still today, because of bad practices of the past.

Oh, that's a good point. In those cases the web server actually needs root, in the sense that it has to be able to upgrade the firmware and reconfigure the network interface.

Reply on news.ycombinator.com