World: r3wp

if i post something, that goes to "console". I do not know how rebol 
handles that. Hopefully it is smart enough to do nothing.

Volker: http://www.cod-okna.cz/cgi-bin/rebol

i try that post-thing. hope graham is right.

thinking about it .. you would have to have a script in the cgi-bin 
directory that the remote user could exploit.

when you start rebol without script, it takes commands from console.. 
at least with from a real console..

Hmm.  So, the remote user could start up multiple consoles?

if that works. never really tried.

can user go outside his cgi-bin directory, if he copies there script, 
with -cs option?

but console ends imo, no?

with the -s yes.

What if the remote user calls rebol with a url as a parameter... 
?

uh ...

but how you give it a parameter? do you make it part of url? But 
apache will fail, no?

take my above url as an example

well, rebol will take a url as a command line parameter

I think url are passed in another way. in read-cgi is "system/options/cgi/query-string"

http://www.cod-okna.cz/cgi-bin/rebolhttp://www.compkarori.com/test.r


The requested URL /cgi-bin/rebol http://www.compkarori.com/test.r
was not found on this server.
Apache/2.0.50 (Fedora) Server at www.cod-okna.cz Port 80

the basics should be something like this. but does not work.

probe read/custom http://www.cod-okna.cz/cgi-bin/rebol[
 post {print "content-type: text/plain^/^/oho^/"}
]

well, I still think it's safe :)

another try, Pekr does not find a new file.

probe read/custom http://www.cod-okna.cz/cgi-bin/rebolprobe [

 post {write %exploited.txt "Ooops" print "content-type: text/plain^/^/oho^/"}
]

-> i hope does not find.

no new rebols in ps - aux output yet :-)

No, that should only run, make a file in rebols dir and quit. Hmm, 
in the current dir, where is that?

no files in-there ....

then Graham is right i think. although i would not do it :)

well, but it is good option to simply make nearly whatever provider 
a rebol hoster :-)

I think that it is legitimate aproach though. IIRC, my first article 
I read in some 1996 regarding cgi, was stating something like - put 
your C app into cgi-bin directory. Back then the author was describing 
that cgi is simply common gateway interface, and that your executable 
app should be put in cgi-bin directory. And rebol is C app :-)

Petr: <<I mean - above block in 'join statement is reduced - is it 
secure?>>

That should be okay.  You could just do a construct/with to create 
an object.

If you are intending to create an object, then pre-process the block 
from decode-cgi to ensure that the word "self" is not used as a keyword 
(tip courtesy of Chris RG, if I remember rightly).

Not sure. Maybe he means main app?

i mean a main app in c.

thanks guys ....

wait! how many sleeping rebols do you want?

url: http://www.cod-okna.cz/cgi-bin/rebol
print "should be fast"
probe attempt[ read probe url]  ; 
print "should be slow"
probe attempt[ 
 read/custom  url probe [
  post {wait 4^/}
 ]
]

and? You are imo reading rebol executable, that is all :-)

he's trying to start it up and leave a console running

No, the second time i do a wait. that should be slower.

ah, but the console would have to get that command (wait 4) - do 
you think it is passed to it?

I think so.

but hard to exploit more. security is on, so only access to cgi-bin 
and childs. cgi-bin should not be writable by the cgi-user. except 
if cgis run as your account, then i could write a script with -cs 
and call that in the next step.

and getting data out does not work, because rebol first prints its 
version-stuff, and webserver thinks "header wrong"

ok, just tried it - Volker is right ...

I can see processes, for one read/custom two of them - dunno why 
...

but you could flood server, running hundreds of instances .... keeping 
them in memory for long time ...

now - is it a rebol vulnerability? Or just putting rebol into cgi-bin 
is the simple cause?

Yes, but i could also call hundreds of regular scripts to keep server 
busy. although this way is  easier, i can allocate lots of mem with 
one call.

I would say: do no exe in cgi if it cant handle cgi. and rebol cant 
(except with script).

but it could protect itself by checking for cgi without -c? So not 
a bug, but a missing feature?

do no exe in cgi -> put no exe in cgi-bin