If you have an Apache web server with a standard configuration, and a cgi scripts that makes use of bash, the log entry for a request may look identical in the following three cases:
- A legitimate request is made.
- A successful attack is performed.
- An attempted attack fails because you have upgraded to a
bash version that disables the vulnerable feature.
The only difference needed to turn a legitimate request into an attack is modification of one of the request headers, which is put into an environment variable.
User-agent header is used to perform the attack, it will be quite visible in the log access log, since that header is logged. But there are other headers which can be used to perform the attack, which are not logged by default.
If an attempted attack failed due to
bash having been updated to the intermediate version that fixed the bug but still allowed functions to be specified through environment, you would see warnings in the error log. They may look like this:
[Thu Sep 25 20:46:51.483207 2014] [cgi:error] [pid 26424] [client 10.82.90.125:55631] AH01215: /bin/bash: warning: HTTP_ACCEPT_LANGUAGE: ignoring function definition attempt
[Thu Sep 25 20:46:51.483316 2014] [cgi:error] [pid 26424] [client 10.82.90.125:55631] AH01215: /bin/bash: error importing function definition for `HTTP_ACCEPT_LANGUAGE'