The developer of a highly-rated ecommerce shopping cart is accused of
building a software backdoor into the program that could give him or hackers
complete control of the server on which it’s installed.
The Dansie Shopping Cart,
which is currently in use at more than 200 e-commerce sites and is
recommended by several Web hosting firms, contains code that enables the
author, Craig Dansie of Moreno Valley, Calif., to potentially run any
command on the Web server.
“He doesn’t have the right to execute commands on our server without our
authorization. That is technically a hack, and he put it into his code
deliberately. It’s unconscionable,” said Joe Harris, a technical support
representative at Blarg Online Services
in Seattle. Harris discovered the hidden capability while helping a client
install the Dansie Shopping Cart, a CGI script written in the Perl language,
and publici
zed his findings earlier this week on the Bugtraq security mailing list.
According to Harris, Dansie built a subroutine into the cart which enables
him to use a nine-character form element or password to remotely execute
commands on the server using the broad security privileges usually assigned
to CGI scripts. But because the password is the same for every installation
of the cart, and because the script must be installed with world-readable
permission, anybody who has access to a server on which the cart is
installed could retrieve the source code and the form element and use it to
control other servers, according to Harris.
“It takes little imagination to dream up the potential havoc and privacy
violations this level of access could result in — from stealing private
customer records to a full-blown crack of an e-commerce server,” said
Harris.
Dansie did not respond to repeated requests for comment. The telephone
number listed in the domain record for dansie.net was disconnected sometime
Thursday. And a list of several hundred customers was removed from the site
Wednesday evening.
Licenses for the Dansie cart start at $150 and range up to $650 for the mall
version which can handle an unlimited number of merchants on the same
server.
According to Kasey Johns, Webmaster for Lonestar Badge and Sign of Martindale,
Texas, the backdoor in the Dansie cart appears to be a means of protecting
against
unauthorized installations and of ensuring compliance with the software’s
licensing terms, which specifically prohibit modifying the source code.
Johns said he learned of the backdoor in late March while trying to debug an
installation problem.
“I tried to make some changes to it, and basically he deleted the script
right off of my server. That just doesn’t seem right,” said Johns.
In an e-mail to Johns Wednesday, Dansie accused him of piracy and asserted
that “The
software has a copyright protection feature that poses NO security risk to
your Web site or your Web server.”
But Johns said Dansie’s anti-piracy efforts are over zealous. “I want the
right to look at the code, make modifications, and not be locked into
whatever ghosts the author has hiding in there,” said Johns.
According to Allan Knight, Webmaster for ValueWebHosting in Williamsville,
New York, which has over 60 hosting clients using the cart, Dansie
recently denied that the program passed information back to him. Knight, who
has been using the cart for three years, said Thursday he was not aware
that the script gave Dansie or others the ability to execute arbitrary
commands. But Knight said he had no plans to stop using the software.
“I have never had any reason to shed any di
strust on Craig whatsoever,” said
Knight.
While Dansie could issue a patch to customers to disable the backdoor,
Harris said prudent users will uninstall the software and find a new
shopping cart provider.
“His credibility is destroyed. Would you ever again trust anybody who did
this? Imagine if it had been Microsoft,” Harris said.
