I'm sure there are some details from the following story that are missing, but this was such a big bag of "WTF?" that I had to share it with you all.
I found a bug in some upload logic that gives anyone read/write access to the filesystem. Raised the alarm, was told that it doesn't matter, that the logic should be that flexible.
So I was going through my morning bugfix routine when I stumbled across some truly idiotic logic in a custom file upload control (ASP.NET). Basically, the user of said file upload can specify where his/her file should be saved. There is no verification that the path is inside the webroot, or that the file that is uploaded is one that should be allowed, or any of the other handful checks that should go into file upload logic. Nothing.
I fixed the control, and wrote up a detailed explanation and analysis. Then I elevated the issue to my boss, who elevated to his boss. They huddled, and when the huddle broke, they decided it wasn't an issue, and that the guy who built the control with this broken logic should be commended for its flexibility.
Turns out all this time I've been misunderstanding "flexibility". What it actually means is "let everyone do anything they want, anytime".
Edit: Yeah yeah permissions, but I can't make that change. I can only do what I can to stop this from happening, and then raise the alarm so that the right people know and can implement the correct fix.
If you then read further down into the comments, you'll discover that the original author of this post apparently works at INITECH.
Didn't he get that memo on TPS report cover sheets?
I was going to rant about the security implications of this out-of-control aspx madness, but I think the risk associated with letting anyone upload and execute anything they want to your webserver is, well, obvious.
September 16, 2009 09:55 AM
Terrible website I tell ya!
September 08, 2009 03:53 PM
Completely agreed... I know a ont-man shop that made a site much better than that... Those images are ridiculously sized!
(Even I could have made a better job, and I'm very lousy when it comes to web design). "
"From the Initech home page .... The principals of the company believe in employing skilled consultants who concentrate first on hearing your concerns related to a particular business or technology issue. The consultant then ensures these concerns are addressed with you in a straight-forward, non-technical manner before any work commences ..... I guess 'Ignore it' is about as non-technical as you can get "
September 02, 2009 02:18 PM
"These are the sorts of classic cases where technology is being built and consumed before anyone starts thinking about security (because that takes time and knowledge) or going slow enough to allow the people who have security minds to ramp up and be able to understand these things and make suggestions/requirements.
Or...some monkey was just stupid.
It's been my observation professionally that unless there is someone catching these things and raising their voice, they happen constantly. It's about tossing the bowling ball down the lane and just ignoring that there may be gutters there. "
I'm sure there are some details from the following story that are missing, but this was such a big bag of "WTF?" that I had to share it with you all.
I found a bug in some upload logic that gives anyone read/write access to the filesystem. Raised the alarm, was told that it doesn't matter, that the logic should be that flexible.
So I was going through my morning bugfix routine when I stumbled across some truly idiotic logic in a custom file upload control (ASP.NET). Basically, the user of said file upload can specify where his/her file should be saved. There is no verification that the path is inside the webroot, or that the file that is uploaded is one that should be allowed, or any of the other handful checks that should go into file upload logic. Nothing.
I fixed the control, and wrote up a detailed explanation and analysis. Then I elevated the issue to my boss, who elevated to his boss. They huddled, and when the huddle broke, they decided it wasn't an issue, and that the guy who built the control with this broken logic should be commended for its flexibility.
Turns out all this time I've been misunderstanding "flexibility". What it actually means is "let everyone do anything they want, anytime".
Edit: Yeah yeah permissions, but I can't make that change. I can only do what I can to stop this from happening, and then raise the alarm so that the right people know and can implement the correct fix.
If you then read further down into the comments, you'll discover that the original author of this post apparently works at INITECH.
Didn't he get that m
emo on TPS report cover sheets?
I was going to rant about the security implications of this out-of-control aspx madness, but I think the risk associated with letting anyone upload and execute anything they want to your webserver is, well, obvious.
September 16, 2009 09:55 AM
Terrible website I tell ya!
September 08, 2009 03:53 PM
Completely agreed... I know a ont-man shop that made a site much better than that... Those images are ridiculously sized!
(Even I could have made a better job, and I'm very lousy when it comes to web design). "
"From the Initech home page .... The principals of the company believe in employing skilled consultants who concentrate first on hearing your concerns related to a particular business or technology issue. The consultant then ensures these concerns are addressed with you in a straight-forward, non-technical manner before any work commences ..... I guess 'Ignore it' is about as non-technical as you can get "
September 02, 2009 02:18 PM
"These are the sorts of classic cases where technology is being built and consumed before anyone starts thinking about security (because that takes time and knowledge) or going slow enough to allow the people who have security minds to ramp up and be able to understand these things and make suggestions/requirements.
Or...some monkey was just stupid.
It's been my observation professionally that unless there is someone catching these things and raising their voice, they happen constantly. It's about tossing the bowling ball down the lane and just ignoring that there may be gutters there. "