Shellshock

securityprogramming

A 2014 family of Bash vulnerabilities that let attackers run commands through crafted environment variables.

Bash mistakenly executed code trailing a function definition passed in an environment variable, and because web servers and other services set such variables from user input, this became remote code execution. Bash is so pervasive across Unix systems that the exposure was enormous.

Shellshock was a flaw in bash's handling of environment variables. Bash could export functions by encoding them in variables, and it kept executing whatever followed the function definition, so any variable an attacker controlled could carry commands that ran automatically when a new shell started.

The reason it was rated as severe as anything in that decade is reachability. CGI web servers put HTTP headers into environment variables and then invoke a shell, so a crafted User-Agent became remote code execution on a huge number of systems with no authentication at all. DHCP clients, mail processors and anything else that passed external data into an environment were similarly exposed, and bash is everywhere.

The bug had been present for roughly twenty-five years, which is the part that reframes it. The initial patch turned out to be incomplete and several follow-up CVEs arrived over the following days, in the middle of the largest emergency patching effort many organizations had run. Together with Heartbleed the same year, it ended the assumption that foundational, ancient, widely-reviewed software is thereby safe.

Also known as: Shellshock, Bashdoor, CVE-2014-6271

← All glossary entries