Shellshock (CVE-2014-6271)
Shellshock is a vulnerability in the GNU Bash shell that was widely used in Unix-based systems. The vulnerability allowed attackers to inject and execute code via environment variables.
Attack Vector
An attacker could trigger the vulnerability by manipulating the HTTP_USER_AGENT variable in HTTP requests to execute arbitrary commands on a web server.
Example Code
Below is an example of an HTTP request exploiting the Shellshock vulnerability:
GET /cgi-bin/any_script.cgi HTTP/1.1
Host: vulnerable.example.com
User-Agent: () { :;}; /bin/bash -c 'echo Hello, I am executing code!'In this example, the User-Agent header contains a Bash function followed by a command to execute. If the web server is vulnerable, it would execute the echo command.