I was looking over the new Bash exploit and was looking at this post in particular.
What I don't understand is how does including bash in the user-agent string cause it to be executed. It seems odd to me that the user agent would ever be executed on the server. I know this i a broad question but I am just looking for a general understanding of how this is allowed to happen if possible.
Doing some further research I read through this which kind of cleared some stuff up for me.
Which explains that CGI is setting some environmental variables and some other input via stdin. Why no guard is in place to keep this from simply being a string is beyond me or why you are able to pass a bash function in a header.