[Zope-Coders] FastCGI leaking Authorization header

[Shane Hathaway]

Matt Behrens wrote:
> On Bug Day I fixed this:
> 
> http://cvs.zope.org/Zope/ZServer/FCGIServer.py.diff?r1=1.17&r2=1.18
> 
> Essentially, (IMO) FastCGI is broken and passes the Authorization
> header as an environment variable called 'Authorization'.  This
> allows pretty much any script, DTML, or other user-creatable object
> to read the Basic auth password when FastCGI is used.
> 
> I think this is worth hotfixing.  It looks like I can make it work
> back to 2.2.0 with no trouble.  Before 2.2.0 there was a lot of
> work in FCGIServer; I am not entirely sure I can make a clean hotfix
> for those versions.  I am also not convinced that is really a
> problem. :-)
> 
> I will write the hotfix if it will be posted.

I don't think we need a hotfix.  Basic auth is insecure, and people who 
use it accept the risk of stolen passwords.  Also, this can only affect 
sites that use FastCGI and allow untrusted users to write scripts. 
There are other, easier ways to attack any site that allows untrusted 
users to write scripts, or even plain HTML, regardless of Zope.  A 
hotfix would draw attention to a chink in the armor when there are 
actually gaping, unfixed holes in the whole web.

Shane