Executive brief
The phf CGI program, an example script included with early web servers, contains a flaw that allows remote attackers to execute arbitrary commands on the server. By sending specially crafted web requests, an attacker can gain full control over the web server, potentially leading to the theft of sensitive data or a complete system takeover. This vulnerability is historically significant as one of the earliest widely exploited web-based command injection flaws.
Technical details
The phf CGI program fails to properly sanitize user input before passing it to a shell command, leading to an OS command injection vulnerability (CWE-78). Specifically, the program does not neutralize shell metacharacters (such as the newline character or semicolons) in the input fields. A remote, unauthenticated attacker can exploit this by submitting a crafted HTTP request containing these characters followed by arbitrary shell commands. This allows the attacker to execute commands with the privileges of the web server user (e.g., 'nobody' or 'www-data'), which can be leveraged for further privilege escalation or data exfiltration.
Affected products
- NCSA/Apache phf CGI program
Timeline
- 1996-03-20: disclosed: Initial public disclosure and NVD publication.
- 1996-12-31: advisory: Included in the 1996 CERT advisory summary.