CVE-2003-1365: Input Validation
The escapedangerouschars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\" (backslash), (2) "?", (3) "~" (tilde), (4) "^" (carat), (5) newline, or (6) carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands, in shell scripts that rely on CGI::Lite to filter such dangerous inputs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For applications using Perl CGI::Lite 2.0 and earlier, implement input validation/sanitization before using user-supplied data in shell commands, file paths, or other sensitive contexts: remove or percent-encode the following characters that CGI::Lite's escape_dangerous_chars fails to strip — backslash (\), question mark (?), tilde (~), caret (^), newline (LF, U+000A), and carriage return (CR, U+000D) — or outright reject requests containing these characters. Do not rely on CGI::Lite::escape_dangerous_chars for this filtering.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1365?
CVE-2003-1365 is considered a high-severity vulnerability due to the potential for arbitrary file access and execution.
How do I fix CVE-2003-1365?
To fix CVE-2003-1365, upgrade CGI::Lite to version 2.01 or later, which corrects the issue with escape_dangerous_chars.
What are the main vulnerabilities associated with CVE-2003-1365?
CVE-2003-1365 allows remote attackers to manipulate special characters, leading to arbitrary file reading or writing.
Which versions of CGI::Lite are affected by CVE-2003-1365?
CGI::Lite versions 2.0 and earlier are affected by CVE-2003-1365.
Can CVE-2003-1365 be exploited remotely?
Yes, CVE-2003-1365 can be exploited remotely, allowing attackers to execute arbitrary code or access files.