2

A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ??

If there are scripts in cgi-bin and only server-admin knows about filenames of scripts in cgi-bin. Is it exploitable by attacker?

How can attacker get to know about names of scripts in cgi-bin?
What are the default script names present in most cgi-enabled servers?

Improve this question
1
  • I read that it might also work if the server side scripts (e.g. php) call an external program, bash may get called (e.g. a system command for ImageMagick or for sendmail).
    – rubo77
    Commented Sep 29, 2014 at 8:04

1 Answer 1

Reset to default
1

You don't mention which server; is it Apache? At the moment, it appears that an attacker must be able to cause a CGI program to run in order to exploit the vulnerability. Having no CGI scripts would seem to offer some protection. Removing mod_cgi from httpd.conf would offer more:

a2dismod cgi
apache2ctl graceful

The second part of your question relies on security by obscurity, which is always a bad idea.

Here's a list of potential CGI scripts/programs: https://docs.google.com/document/d/1vN2QOG2OZIAHGXDmd5wB8FPi-Hin2GaIlWRJ0RYkTbA/edit I didn't compile this list, and have not attempted to vet it for completeness.

Improve this answer
3
  • How would you have to check your server against this list?
    – rubo77
    Commented Sep 29, 2014 at 7:47
  • shellshock.detectify.com will do it for you. (I haven't vetted this.)
    – Bob Brown
    Commented Sep 29, 2014 at 7:58
  • shellshock.detectify.com will iterate over a list of possible cgi-URLs until it finds a vulnerable end-point where it will inject a harmless payload.
    – rubo77
    Commented Sep 29, 2014 at 9:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .