I want to know if my servers are still vulnerable under the following conditions...

  1. My servers are private - only myself and trusted developers have access to them
  2. We have enabled executables within PHP/Node/Python - but we never use post/get data.
  3. We have some public webpages.
  4. Edit - to clarify - PHP and Python do not run via mod_cgi

To answer your question: 1. There is no SHELLSHOCK threat as long you and your co-developers are aware what environment variable you are putting in or modifying (if any).

  1. By enabling executables, do you mean you call system binary via shell? If your Python or PHP is running via mod_cgi, there is vulnerability even if you don't use GET or POST data. To my knowledge, mod_python, mod_php is not compromised to the threat.

  2. Exposing public page opens the same vulnerability as mentioned in point 2 as long as they run via mod_cgi.

  • 1
    mod_python or mod_php would allow the CGI script to be vulnerable (if it uses the equivalent of the system function without clearing the inheritable environment) – Ben Voigt Sep 26 '14 at 14:35
  • Thanks - We do not call python or php with mod_cgi. – Boz Sep 26 '14 at 17:35
  • @BenVoigt - How does inheriting the environment cause a threat? – Boz Sep 26 '14 at 17:40
  • 1
    @Boz: The C runtime function system(), which has wrappers in many scripting languages, e.g. os.system() in python, launches a shell as a child process, passing the specified command. If that shell is bash, it will process the environment during startup. Now, mod_python presumably passes the connection parameters internally, without placing them in the environment. But if your script both sets environment variables from user input and uses os.system(), you could be affected. – Ben Voigt Sep 26 '14 at 18:17
  • 1
    @Boz: The impact of this vulnerability is that user input in environment variables is dangerous, even if you don't allow unsafe user input on the actual system() command line. And people don't sanitize environment variables the same way they do the commandline, both mod_cgi and DHCP hooks (dhclient, dnsmasq, probably others) actually use environment variables to pass unsanitized user input to the callback script. – Ben Voigt Sep 26 '14 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.