Shellshock
- Product
- GNU Bash
- CVE
- CVE-2014-6271CVE-2014-7169CVE-2014-6277CVE-2014-6278CVE-2014-7186CVE-2014-7187
- Disclosed
- 2014-09-24
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- GNU Bash through 4.3 (bug present since ~1989, Bash 1.03)
- Fixed
- bash43-025 (initial, incomplete), bash43-027 and later complete the fix; vendor backports for older series
Summary
Bash parsed function definitions exported through environment variables and kept executing any commands that followed the definition. Since CGI scripts, DHCP clients, OpenSSH ForceCommand and others copy attacker data into environment variables, a single HTTP header could run commands on the server. Several follow-up CVEs came from incomplete fixes.
Root cause
When Bash started, it imported any environment variable whose value began with '() {' as a function definition by passing the whole string to the parser. The parser did not stop at the end of the function body, so trailing commands were executed during import. Later parser bugs (CVE-2014-7169, -6277, -6278, -7186, -7187) were found in the same import path before Bash moved exported functions to prefixed variable names.
Impact
Unauthenticated remote command execution via CGI web servers, DHCP clients, and other services that pass untrusted data to Bash in environment variables.
Public PoC
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
# Patched bash prints only: this is a testSource: Red Hat Security Blog (local check)
Detection
Look for '() {' in HTTP headers (User-Agent, Referer, Cookie) in web and IDS logs. Run the local env test below to check a host. Nuclei template CVE-2014-6271 targets CGI endpoints.
Mitigation
Update Bash from your OS vendor and remove or disable legacy CGI scripts that invoke shells.