Editing Perl file through the URL

[noshankus]

Hello,

I am testing one of our work servers (running on Linux), and I can navigate to upper levels that were not expected to be able to be viewed.

I have access to a perl file (not 100% sure what it does exactly), but I can view it's contects by simply entering the URL http://www.mybox.com/folder/../perl.pl <- which is basically contained in the parent folder of "folder". i.e. same as ...mybox.com/perl.pl

I have two questions:

1. Is this file able to be executed? - If so, how?

2. Is it possible that Linux commands can be executed from the URL, such as awk to replace existing code with malicious code? - obviously then executed. I assume that some unicode will be necessary for the spaces inbetween the arguments of this.

Thank you very much for your help.

[error27]

Normally most webservers have a seperate directory for files that are viewed and for files that are executed.

The configuration files are in the /etc/ directory somewhere. (/etc/apache on debian. /etc/httpd/ i think on redhat.). You should probably check them out.

redhat has a program called redhat-config-httpd
that simplifies life.

in answer to Q#2. cgi files are executed and you can pass parameters to them. definately you shouldn't install cgi scripts if you don't need to.

most distributions set it up so that the web server has limited permisions. so if an apache script tries to "rm -rf /" it probably won't be able to...

[noshankus]

Thanks for the help =)