-NoExecCGI and images

[inetbizo]

We're trying to prevent hackers from uploading perl scripts into apache writable folders in our ecommerce packages. Adding -NoExecCGI disables view of images on the rendered page. What would be a good solution to prevent XSS attacks using perl from a post to folder where images are stored?

 

[ModServ]

This error because of 500 Internal Server Error because of there isn't something named "-NoExecCGI" it's named "-ExecCGI"

To allow it then you have to put "+ExecCGI" to disable "-ExecCGI"

You can put these in the main httpd.conf replacing the current in the " Directory "/" "

<Directory "/">
    Options -ExecCGI -FollowSymLinks -Includes IncludesNOEXEC Indexes -MultiViews SymLinksIfOwnerMatch
    AllowOverride AuthConfig Indexes Limit FileInfo Options=IncludesNOEXEC,Indexes,Includes,MultiViews,SymLinksIfOwnerMatch
</Directory>

Also you can simply put a rule into Mod Security to prevent working with *.pl...