is it OK to grant permission for IUSR_ to cmd.exe?

Question

One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for working good. What do you think?

Answer 1

In my opinion, there are two problems here:

1. Your developer is directly spawning shells to perform operations. This is a sign of poor quality code, a dodgy workaround, or your developer not having enough time / experience to perform the operation himself. You need to find out which it is.
2. Allowing _IUSR access to cmd.exe opens up some nasty possibilities for shellcode, should your IIS service later be found to be vulnerable to a remote code execution bug.

Ask him exactly what he's launching, and ask if he can find a workaround. If he's running some sort of external task, why isn't he using the Windows Task Scheduler API rather than directly spawning shells? If he's using an existing utility (e.g. xcopy, ping, etc.) as a hacky workaround you should ask him to do it properly, and allocate the appropriate time and resources for him to do so.

Remember that a flat "no" is useless to him as a developer. Explain exactly why it'd be a security issue. If possible, back it up with something from your security policy. Try to be empathetic of his situation - developers usually have 6 months worth of work to get done in 6 weeks, so a workaround is golden. If it's a case of him not having the time to do the job properly, speak to the project manager and see if the scope can be altered.