Sudoers files requiretty flag security implications

Question

So I am trying to execute sudo commands via cgi-bin perl scripts. I want to give sudo access to the apache user for a small subset of commands. Someone before me may have set the requiretty flag. Things like cron and cgi-bin scripts do not get a tty session, so currently if i try to sudo in my script, it tells me about the flag. Also, the apache user will sudo without a password.

My question to you all is, what are the security implications if I were to disable this flag and continue writing my script?

Answer 1

If your script was prone to any sort of injection, all commands entered by a malicious user would be run as root. I don't think it gets any more dangerous than that :)

I ran into this same issue a while ago. I ended up having user jobs submitted into a "queue folder", which was processed by a script I ran through a crontab every few minutes. The files in the queue were parsed by my scripts with regular expressions and any files which contained invalid characters (eg. .*<-_>![]{}()\|/;) were discarded and the user was notified to resubmit.