An Old Form Script Still Sitting in cgi-bin

A folder nobody opens

Many web servers have a folder called cgi-bin, set aside for small programs that run when a page asks them to.

Around 2003, the usual way to make a contact form send email was to upload a free script there and point the form at it.

Since then the site has probably been redesigned once or twice, and the form replaced with something newer. The old script was never deleted, because nobody deletes files they do not recognise.

It is still there, and it still works. That is the trouble.

How old form scripts get abused

Many early form scripts took the address to send to from the form itself, in a hidden field. Change that field, and the script sends to whoever you like.

The oldest versions did not check it. Anyone could send a request straight to the script, with their own list of recipients and their own message, and your server would deliver it.

Spammers do not need to find your contact page to do this. Their programs check thousands of sites for the usual file names of popular old scripts and use whatever answers.

Later versions of these scripts closed the gap. A copy uploaded in 2003 and never touched has not.

What it costs a business

• The server's address lands on spam blacklists.
• Your own email to customers starts bouncing.
• Form enquiries stop arriving, or land in spam folders.
• The host may suspend the account to protect its other customers.
• Other sites on the same shared server suffer alongside yours.

The second is usually how a business finds out. Quotes and invoices come back refused, and the bounce message names a blacklist the owner has never heard of.

Why it was never deleted

Redesigns add files far more often than they remove them. The new designer builds in a new folder, the new form works, and the old one is simply forgotten.

Its name means nothing to anyone in the office. A file called mailer.cgi or form.pl does not look dangerous, and nobody remembers uploading it.

The old contact page often survives too, at its old address, still reachable from search results and still sending to the old script.

Finding leftover scripts

Open the cgi-bin folder, through the host's file manager or an FTP program, and list every file in it with its date.

Look in the site's main folder as well for anything ending in .pl or .cgi, and for old mail scripts in PHP with names like sendmail or contact, dated years before the current design.

Ask the host for the server's access logs. A string of requests to an old script from addresses all over the world, with nobody visiting the page that used to hold the form, is the pattern to look for.

Then check whether the server's address is already listed. Several free blacklist lookups take the address and report each list it appears on.

Deleting them safely

Download a copy of each old file first, so nothing is lost if one turns out to matter.

Confirm the current form does not use any of them by reading where it sends its data, then delete them. Send a test enquiry through the current form straight afterwards.

Remove the old contact page, or redirect its address to the current one.

If spam was going out, ask the host to clear messages still waiting in the mail queue, then request removal from each blacklist. Many drop an address on their own once the spam stops.

A worked example

A fly fishing guide who runs day trips on two rivers, with a second guide hired for the summer, had his first website built in 2003 by a client who did web work on the side.

Its trip request form posted to a script in cgi-bin. A redesign in 2011 gave him a new form, and the old script stayed where it was, along with the old request page.

In March, as bookings for the season began, his replies to customers started bouncing. The host traced it to the old script, which had been relaying spam for weeks.

The host stopped outgoing mail from the account for a day while the old files were deleted, the queue was cleared, and removal was requested from the blacklists.

The old request page now redirects to the current one, which sends from an address on his own domain. He sends himself a test request every month.

One maintained form

The safe arrangement is a single form, kept current, with the recipient fixed in the server's own settings, where nobody outside can change it.

Give it spam protection, such as a hidden field that only automated programs fill in, or a simple test that only a person can pass.

Messages it sends should come from your own domain, with the visitor's email in the reply-to line, so receiving servers accept them and replies go straight back to the customer.

And make it part of software that gets updates, so the next weakness is fixed by someone whose job it is.

Other leftovers in the same places

Old form scripts are rarely alone. The same folders tend to hold visitor counters, guestbooks, upload scripts and test files from the same era.

Old copies of whole sites turn up too, in folders named old or backup, or as a zip file of the previous design that anyone can download.

Each is a target for the same kind of scanning, and none is doing anything useful. Treat them like the form script: copy, confirm, delete.

The counter-case

Some hosts have switched off scripts in cgi-bin entirely, or cap how much mail an account can send in an hour, which limits the damage an old script can do.

A site that has never been redesigned may also have nothing left over, because its only form is the one in use. That form still needs checking against the same weaknesses.

A cap is not a cure, though. Find the leftover scripts, delete them, and keep one maintained form.

This week

1. Open the cgi-bin folder and list every file.
2. Search the main folder for old .pl and .cgi files.
3. Download copies, then delete scripts nothing uses.
4. Remove or redirect old contact pages still online.
5. Look up your server's address on blacklists.
6. Test the current form from a phone.
7. Delete old files after every redesign.

Step three is the only one that actually stops the abuse. Everything else finds the problem or repairs the damage; deleting the script removes what the spammers' programs were looking for.

Abandoned software left running on a server is the same problem described in a site still running Joomla 1.5.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.