Beefy Boxes and Bandwidth Generously Provided by pair Networks
Just another Perl shrine

Re^6: 'do' command is dead? Surely not?

by tobyink (Canon)
on May 19, 2017 at 15:09 UTC ( #1190639=note: print w/replies, xml ) Need Help??

in reply to Re^5: 'do' command is dead? Surely not?
in thread 'do' command is dead? Surely not?

Because something as seemingly safe as use strict can load from the current working directory, which might be somewhere globally writable like "/tmp/".

There was apparently a real-world way of exploiting this to do nasty stuff, but the Perl development team haven't yet publicly disclosed what it is. I imagine it's an exploit in some commonly used Perl web app like cPanel or Webmin. They do plan on releasing the info eventually, once they've decided people have had enough time to move to newer Perl versions which don't have "." in @INC by default.

Replies are listed 'Best First'.
Re^7: 'do' command is dead? Surely not?
by KurtZ (Friar) on May 19, 2017 at 15:53 UTC
    I see, thanks. :)
Re^7: 'do' command is dead? Surely not?
by Anonymous Monk on May 19, 2017 at 17:58 UTC

    That sounds false, cause . was last in @INC for a long time, so from /tmp is not a situation that could have happened

      Maybe not but some other (optional) module that was not present in the original system could still be loaded from /tmp.

        the program would have to be trying to load said module first ... its expecting it to exist

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1190639]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (7)
As of 2019-10-14 23:53 GMT
Find Nodes?
    Voting Booth?