vaibhav91one/shellshock-cve-labIntentionally vulnerable CGI lab for Shellshock (CVE-2014-6271) with a Python RFC-3875 server and GNU bash 4.2, designed for isolated security testing and education.
This repository contains a small CGI lab for CVE-2014-6271. It compiles GNU bash 4.2, serves a CGI script through a Python RFC-3875-style server, and maps request headers into CGI environment variables.
Sentinel reproduced this scenario on 2026-08-27 as a from-scratch sandbox lab.
This is an intentionally vulnerable lab. Run it only in an isolated local or sandbox environment.
docker build -t shellshock-cve-lab .
docker run --rm -p 8080:8080 shellshock-cve-lab
The target listens on HTTP port 8080. The CGI route is /cgi-bin/hello.
BountyDesk should treat this repository as target code only. The TrueForge
agent must investigate the running target through the platform harness, using
probe_target for read-only requests and probe_target_write for any
state-changing request that needs approval. No script in this repository is an
authoritative verdict source.
Evidence source: demo/evidence/shellshock-cve-2014-6271-blind-build.md in the Sentinel repo.