0

I'm not sure if this question could be consider inappropriate here.

$ python -m http.server

The source code tells:

# https://hg.python.org/cpython/file/3.5/Lib/http/server.py#l21

SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL
-- it may execute arbitrary Python code or external programs.

How could someone may execute code if the server is only showing files? Is someone safe behind UFW defaults? (just allowing the chosen port 8000/tcp)

1
  • 1
    My question is why it isn't secure
    – autorun
    Feb 28, 2016 at 2:15

1 Answer 1

2

The warning is under the header of

Notes on CGIHTTPRequestHandler

The CGI handler can be used to execute arbitrary program. If you just want to serve static files, you should use the SimpleHTTPRequestHandler.

In either case, the HTTP servers included in python aren't many for production uses, they are simple server for quick demos and lack many important functionalities and security hardening necessary for a production environment.

The firewall note is about that, in if you don't control who can connect to your local machine, you may be in for a security trouble even for local testing, if you have a malicious user connected to the same network.

1
  • Ok, I missed the header. Yes, I'm just sharing some files over the internet, and I wonder if I'm too exposed. I'm using SimpleHTTPRequestHandler. Is there any easy example about how someone could execute his code when server is on cgi mode?
    – autorun
    Feb 28, 2016 at 14:43

Not the answer you're looking for? Browse other questions tagged .