Courses / Remote Code Execution (RCE)

Shellshock (CVE-2014-6271)

Last Edit: 10-05-2024

Shellshock (CVE-2014-6271)

Shellshock is a vulnerability in the GNU Bash shell that was widely used in Unix-based systems. The vulnerability allowed attackers to inject and execute code via environment variables.

Attack Vector

An attacker could trigger the vulnerability by manipulating the HTTP_USER_AGENT variable in HTTP requests to execute arbitrary commands on a web server.

Example Code

Below is an example of an HTTP request exploiting the Shellshock vulnerability:

GET /cgi-bin/any_script.cgi HTTP/1.1 
Host: vulnerable.example.com 
User-Agent: () { :;}; /bin/bash -c 'echo Hello, I am executing code!'

In this example, the User-Agent header contains a Bash function followed by a command to execute. If the web server is vulnerable, it would execute the echo command.


Question Answer the question below to validate the course and earn easy points:

Which header is mostly used to exploit Shellshock?