Shellshock is the name for CVE-2014-6271 and follow-up bugs in GNU Bash through version 4.3, disclosed on September 24, 2014. Bash imported function definitions from environment variables and also ran any commands placed after the definition, so a variable like () { :; }; /bin/id executed id as soon as Bash started. Web servers using CGI copy request headers into environment variables, so a single crafted User-Agent header gave remote code execution. Patched Bash releases closed it; the CVSS score was 10.0.
What Shellshock is
Bash lets a parent process pass a shell function to a child through an environment variable whose value starts with () {. When a new Bash started, it parsed those variables to rebuild the functions, and a parsing flaw meant it kept executing whatever came after the closing brace.
On its own that is a local quirk. It became remote because many systems put attacker-controlled data into environment variables before invoking Bash: CGI web servers (headers become HTTP_USER_AGENT and friends), DHCP clients, some SSH forced-command setups and embedded device web interfaces. The first patch was incomplete, and several follow-up CVEs (CVE-2014-6277, -6278, -7169, -7186, -7187) were fixed over the following days. It is an OS command injection through an unexpected door.
How the attack works and how to test
Shown for defensive context:
- Local test:
env x='() { :;}; echo vulnerable' bash -c "echo test". A patched Bash prints onlytest; a vulnerable one printsvulnerablefirst. - Remote CGI attack: a request to a CGI script with a header such as
User-Agent: () { :; }; /bin/bash -c 'id'. The server copies the header into an environment variable, starts Bash to run the script and executes the appended command. - What followed in 2014: botnets scanned the internet for
/cgi-bin/paths within hours, dropping malware and opening reverse shells.
Shellshock still turns up in old embedded devices, appliances and forgotten CGI scripts during internal penetration tests.
How to fix and defend
- Patch Bash through your operating system vendor. Any supported distribution has carried fixed Bash for years; the risk now lives in unpatched appliances, IoT devices and end-of-life systems.
- Retire CGI where you can, and never let CGI scripts run through Bash with request data in the environment.
- Inventory embedded devices with web interfaces, since many ran Bash or a vulnerable shell and never received updates.
- Hunt for
() {in web server logs, which is the signature of Shellshock probes.
References
- [1]NVD: CVE-2014-6271(NIST NVD)
- [2]MITRE CWE-78: OS Command Injection(MITRE)
- [3]CISA Known Exploited Vulnerabilities Catalog(CISA)
- [4]MITRE ATT&CK: Exploit Public-Facing Application (T1190)(MITRE)