[Xitami] Security issue with Xitami and CGI

[Robert Gilbertson]

This is a multi-part message in MIME format.

------=_NextPart_000_0487_01C365E8.E6754910
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

I don't know if anyone else has noticed this problem, but I tried =
realligning the location of the cgi-bin from E:\Xitami\cgi-bin to =
E:\Xitami\Webpages\cgi-bin to make the physical location of the cgi =
directory closer reflect the virtual location (as typed in the browser =
bar).

The problem is that, while Xitami then recognises cgi-bin as a cgi =
directory, it does not recognise CGI-BIN, or any other variation in =
case. All anyone has to do is change the case of the cgi directory in =
the URL bar of their browser, and, unless the script has been cached by =
the server, the visitor will be prompted to download the perl script.

As a temporary measure, you can enter the administration panel and =
change:

In the server settings,  change 'CGI URLs start with' to '/', and=20
In the CGI settings, check 'Allow file mixing'.

Xitami now decides by itself whether it is an executable script or not, =
without reference to its location.



------=_NextPart_000_0487_01C365E8.E6754910
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>I don't know if anyone else has noticed =
this=20
problem, but I tried realligning the location of the cgi-bin from=20
E:\Xitami\cgi-bin to E:\Xitami\Webpages\cgi-bin to make the physical =
location of=20
the cgi directory closer reflect the virtual location (as typed in the =
browser=20
bar).</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>The problem is that, while Xitami then =
recognises=20
cgi-bin as a cgi directory, it does not recognise CGI-BIN, or any other=20
variation in case. All anyone has to do is change the case of the cgi =
directory=20
in the URL bar of their browser, and, unless the script has been cached =
by the=20
server, the visitor will be prompted to download the perl =
script.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>As a temporary measure, you can enter =
the=20
administration panel and change:</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>In the server settings,&nbsp; change =
'CGI URLs=20
start with' to '/', </FONT><FONT face=3DArial size=3D2>and </FONT></DIV>
<DIV><FONT face=3DArial size=3D2>In the CGI settings,&nbsp;check 'Allow =
file=20
mixing'.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Xitami now decides by itself whether it =
is an=20
executable script or not, without reference to its =
location.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV></BODY></HTML>

------=_NextPart_000_0487_01C365E8.E6754910--