header-logo
Suggest Exploit
vendor:
Bash
by:
9
CVSS
CRITICAL
Command Injection
78
CWE
Product Name: Bash
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE: CVE-2010-0238
CPE: a:gnu:bash
Metasploit:
Other Scripts:
Platforms Tested: Linux, Unix, macOS
2010

Command Injection Vulnerability in GNU Bash

The vulnerability exists in GNU Bash due to inadequate sanitization of control characters in the 'ls' command. Attackers can exploit this vulnerability to execute arbitrary commands in a bash terminal. Other attacks may also be possible.

Mitigation:

To mitigate this vulnerability, it is recommended to ensure that input is properly sanitized and validated before being executed as a command. Regularly updating the GNU Bash version to the latest released version is also advised.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/37776/info

GNU Bash is prone to a command-injection vulnerability because it fails to adequately sanitize control characters in the 'ls' command.

Attackers can exploit this issue to execute arbitrary commands in a bash terminal; other attacks may also be possible. 

The following example is available:

1. mkdir $(echo -e 'couc\x08\x08asd')
2. ls

Displays:
coasd/

Expected:
couc??asd/

Navigation

Suggest Exploit

Services By CQR