bankshot
macrumors 65816
Alexander said:You probably don't have anything in your web directory with a resource fork, but you can also access the data fork:
Code:http://localhost/dev/database_connector.php/..namedfork/data
and stare wide-eyed at the result. If you know the URL, you can also access files in password-protected directories like this.
Yikes, that is a pretty huge hole. I just tested it on another Mac site which I know runs OS X, and yep, it worked. I let the administrators know.
Honestly, this is the kind of stuff a lot of Mac and Unix users like to be smug about when it happens to Microsoft. We say they spent too much time adding features to their OS/apps and not enough time making it simple and secure. Yet here we are - HFS+ allows access to files in this manner as a convenient feature, but nobody thought of the numerous security ramifications. I'd be willing to bet that there's probably another exploit hidden here for another application. Apache is just one app that could potentially make use of this in a harmful way, and it happened because most systems that run Apache don't have this functionality, so the Apache people never thought about it. It took somebody this long to connect the dots and see the problem. How many other unconnected dots are out there?
Many of us wish Apple and Macs would become more popular - there are numerous benefits to this (better availability of software being chief among them). But what if this turns enough attention on OS X that exploits for these things start coming out before they are found and fixed? We may rue the day the Mac got popular...
Kudos to Apple for fixing it and notifying their users.