I’ve got an ASP.Net web app that needs to run processing tasks from time to time, based on the actions of an admin user. One of the tasks I’m looking at will require shelling out to run an a command-line app, to securely transfer a file. I have no choice but to use the command-line app I’ve been provided.
The ASP.Net page in question will call into my dll, and if the dll determines that the command-line app needs to be executed, it will do so.
I’m wondering about the potential security issues around setting this up, though. Is this stupid and/or dangerous? Can anyone comment, or suggest how I might safely tackle this problem?
Thanks.
A lot depends on what the command line app is and what it can do. The biggest concern would be allowing user input to control what that app does. Is the file that is being transferred uploaded by the user? If so you may have opened yourself up for a trojan horse.
As far as safely tackling this…
Create a user account just for your application and then create a new IIS app pool and set the identity to this account. Configure your web application to use this app pool. Now only give that account permissions to resources required by your web app and command line helper app. When the web app launches this command line helper, it will run the command line process under the same security context as the app pool.
If an attacker tries to commandeer your system by manipulating the command line app, he should be foiled by operating system security. If your web app or helper app require so many privileges to run that the application account must be granted enough privileges that a human logged on locally with that account could modify system settings then you are in a very risky situation. Just say no!.