Anonymous user vulnerability

Anonymous user is given WRITE permission within its WWW/DB folder only and I don¬t see any security risk involved with that. :)

Aziz?

Hi,
I don¬t understand. I think that functionality is it is completely unnecessary and very dangerous. Never an anonymous user can be taken Write on WWW!

http://hostingcontroller.com/english/logs/hotfixlogv61_1_4.html
said:

Improvements

The ACL manager now allows adding/editing of web anonymous user account.
The anonymous user is now automatically given READ/WRITE permission over WWW & DB folder. This ensures proper functioning of database driven websites.

If any user have a execute over WWW!! Hacking Attack is 100 % possible!!!
I think that if an user by means of ACL can add permits execute it has more than enough www, any user (WEBADMIN) it can destroy a server.

Some convincing answer?

Best regards,

Hi,
Please remove this serious possible big bug!

Microsoft never recommended the attribute WRITE for the WWW sites!
http://support.microsoft.com/kb/187506/en-us

Also any WEBAMIN can be destroying the server with this feature.

Thanks!

Thanks for the input, everyone.

Before you verdict this as a vulnerability you need to understand the security structure we implement on the website. Each website is given a unique anonymous user (domain.com_web). This user is not same as IUSR_MACHINE as this has only rights on its designated folders. This policy makes it possible that when EVERYONE is removed nobody can access others data on shared server.

Having this said, when we give WRITE permission to Domain.com_Web user, it means that we are allowing the site owner to write such scripts that may create files in his WWW folder ONLY and read/write database IF it is also uplodated in the WWW folder (many novice developers do this). It is important to understand this Domain.com_Web is a unique user whom we give WRITE right only on designated WWW/DB folder and technically speaking there is no way he could access other places or destroy the server.

I understand that Microsoft support may have suggested not to give write permission but did you tell them the exact scenario and did you ask them how database is manpulated if we remove anonymous write access?

In short, I assure you, to the best of my knowledge and experience, that WRITE permission is not a security threat for server rather it eases additional support burden from your shoulder.

Thanks for listening to us.

On one of my systems HC has been giving anonymous user write permissions on www folder for as long as I can remember (which is at least a few months - heheh)

My 2 cents:

I would tend to agree that anon user should not have write permission on www folder by default (but it is good that ACL manager allows for configuring anon user instead of Everyone). True, MS comments on the subject does refer to the default installation of IIS, however, it is also true that according to MS Best Practices one should always apply the Principle of Least Privelege when setting ntfs permissions. Thus anon user should have write permission on www folder only when all files in that folder requires it - a rare example; moreover, it should not be inherited by subfolders. If a single file among many files in www requires write then only the file should receive it.

That is my point exactly, webmins should decide which folders need to allow write permissions but allowing the entire www directory anon write seems to be a disaster waiting to happen.

I can just see this months down the road where a worm comes out and sites with certain conditions (amongs which anon write) are affected. Then we will all be scrambling to fix.

Any comments anyone?

Hello

I was mixed when reading release notes about this feature too. However, I tend to agree with HC this has (or should have) limited scope.

As they wrote, specific website anon user will get write access to website folders. If server ACL is properly configured, this would mean that only that specific website folders are under moderate risk, not the server itself or other websites.

Risk is someone might exploit a bug in code to gain write access to that website folers and only to them. I guess HC was trying to provide a more "relaxed" setup in order to provide advantages to all those users who deploy pre-made websites / CMS which usually might require write access to some or all folders. However, a risk that bugs could be exploited to gain write access to website folders actually exists. Of course, IUSR_server account is not involved as anonymous user for a specific website is not IUSR_server account.

However, if ACL for your server are not properly configured, that server is under threat of being hacked even if anonymous user for a website only has read privileges for those folders. If that user can get outside a fair scope (for example, it could be able to read c:\) that¬s not properly configured!

My take: ACL management is maybe hardest part to learn. Instead of relaxed ACL settings, HC might provide wizards for novice users to guide them in a simple way. For example, instead of allowing them to change ACL settings, a wizard could ask:

--- ACL WIZARD ---
Do you want to enable write access for:

[ ] entire website
[ ] a database folder
[ ] only a specific folder

Option:

[ ] also set same access to child objects

----- ACL WIZARD -----

Of course, expert users should be able to set manually ACLs but this could help novice users to balance between security and flexibility.

Regards.

In other words, what you are saying is: its ok if a website is open to hacking since only that site will be destroyed? These are customers, not just html files!

Moreoever, server could be compromised by hacker using resources assigned to webadmin for things like proxy, providing a launching site for hacking other servers, warez, etc.

Is this feature worth having HC¬s customers concerned about security.. If not I would change the permissions back.

Evreryone is talking about security, hacking, exploits, and such stuff but I still don¬t understand where the risk lies. We know the theory, let¬s be practicle. Would anyone gives us a practicle demonstration of "Write Pemrission Exploit" on our demo server?

Sorry for late follow-up on this thread. I don¬t understand why I shall enable WRITE permission on website? This is security problem, we know, and we never said HC does this. All you should ask is "I don¬t know how to hack, but maybe if you give me the site name and enable anonymous WRITE permission on the WWW folder of a domain I will give it a try" ..