Shellshock — Bash CGI vulnerability

Shellshock is a vulnerability affecting older versions of GNU Bash. The issue allows commands appended after a specially crafted function definition stored in an environment variable to be executed when Bash processes that variable.

CVE-2014-6271 is the original vulnerability commonly associated with Shellshock. Additional related Bash issues were discovered afterward, but CVE-2014-6271 is the main identifier to remember.

Bash historically supported exporting shell functions through environment variables. Vulnerable versions continued parsing content after the function definition, which could cause additional commands to execute.

The characteristic Shellshock pattern begins with an empty Bash function definition followed by additional shell commands.

A Bash installation can be tested locally by placing the crafted function definition into an environment variable and starting a new Bash process.

If the unexpected word vulnerable is executed before the normal command output, the Bash version exhibits the original Shellshock behaviour. Patched versions should not execute the appended command.

CGI, or Common Gateway Interface, is a mechanism that allows a web server to execute external programs or scripts and use their output to generate HTTP responses.

Some CGI environments convert HTTP request metadata into environment variables before executing a script. If the CGI program invokes vulnerable Bash, attacker-controlled HTTP headers can potentially reach Bash as environment variables.

CGI implementations commonly transform request headers into environment variables. For example, the User-Agent header may become HTTP_USER_AGENT. This creates the bridge between an HTTP request and vulnerable Bash processing.

A common Shellshock exposure requires a CGI endpoint, a vulnerable Bash installation and a code path in which attacker-controlled environment variables are processed by Bash.

Before testing Shellshock, identify whether the web server exposes CGI directories or scripts. Common historical locations include /cgi-bin/.

A controlled Shellshock test sends the characteristic Bash function pattern through an HTTP header to a suspected CGI endpoint and checks whether a harmless marker command is executed.

User-Agent is commonly demonstrated because CGI may expose it to the executed program through the HTTP_USER_AGENT environment variable. Other request headers can potentially reach the CGI environment as well.

The presence of /cgi-bin/ alone does not prove Shellshock. The backend must ultimately involve a vulnerable Bash process that parses attacker-controlled environment variables.

Nmap includes an NSE script designed to test suspected CGI endpoints for Shellshock behaviour.

If the CGI endpoint is served over HTTPS, the same vulnerability concept applies because TLS only protects transport. It does not remove the underlying Bash parsing vulnerability.

Metasploit includes modules for Shellshock exploitation against compatible CGI configurations. Search the framework for shellshock modules and review the target URI and required options before use.

If attacker-controlled data reaches vulnerable Bash and Bash executes the appended command, the attacker may gain command execution with the privileges of the web server or CGI process.

Successful command execution does not necessarily mean root access. Commands normally execute under the account used by the web server or CGI process, such as www-data, apache or another restricted service account.

After confirming the vulnerability in an authorised lab, first identify the execution context and system information rather than assuming administrative privileges.

The practical conditions to remember are: vulnerable Bash, attacker-controlled environment data and a program or service that invokes Bash in a way that processes that environment. CGI was a major remote attack vector because HTTP headers could become environment variables.

The primary mitigation is to update Bash to a patched version. Systems should also remove unnecessary CGI functionality, reduce exposed attack surface and run web services with restricted privileges.

The installed Bash version can provide useful context, but patch status should not be determined from the version string alone because distributions may backport security fixes.

Generic web enumeration may discover CGI scripts and server information, but Shellshock is a specific vulnerability test. It belongs separately from the general Web Server Enumeration note.

Identify the web server and CGI endpoints, determine whether Bash may be involved, perform a harmless marker test or use the Nmap Shellshock script, and then confirm the execution context if the vulnerability is present.

These are the Shellshock concepts and commands worth remembering.