Executive brief
The jj CGI program, a web-based script, contains a security flaw that allows unauthorized individuals to run commands on the underlying web server. By sending specially crafted requests, an attacker could gain control over the server, potentially leading to data theft or service disruption. This vulnerability poses a high risk as it can be exploited remotely without needing a password.
Technical details
The jj CGI program is vulnerable to OS command injection due to improper sanitization of input containing shell metacharacters. A remote, unauthenticated attacker can exploit this by submitting malicious characters (such as semicolons or pipes) through web requests to the CGI script. Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the web server process. This is a classic input validation failure in early web gateway interface scripts.
Affected products
- jj CGI program
Timeline
- 1996-12-24: disclosed