Re: web application call executable code to serve client req

vincente13@xxxxxxxxx writes:

Todd H. wrote:
There certainly could be.

You'll want to scrub the daylights out of any user-supplied
data/arguments being passed to that executable via any form to make
sure you don't allow the "execute this" web request to allow users to
run arbitrary commands on the system.

And if it's taking arguments supplied by the user, you'll also want to
make sure there aren't any buffer overflow vulnerabilities in that
application via the command line arguments.

Would take note of that and is there any articles regarding this issues
on the Internet i can refer on?

Hunt down the OWASP Project and the OWASP guide, open web application
security project.
http://www.owasp.org/index.php/Guide_Table_of_Contents

Chapters 6 15 and 21 will be of most
interest to your work.


--
Todd H.
http://www.toddh.net/
.

Relevant Pages

  • Re: web application call executable code to serve client req
    ... Im would like to know if there is any web application security issue in ... file that will be executed upon clients requests through the web and ... sure you don't allow the "execute this" web request to allow users to ... run arbitrary commands on the system. ...
    (comp.security.misc)
  • Re: web application call executable code to serve client req
    ... You'll want to scrub the daylights out of any user-supplied ... data/arguments being passed to that executable via any form to make ... sure you don't allow the "execute this" web request to allow users to ... run arbitrary commands on the system. ...
    (comp.security.misc)