1

I am running a java webapplication ( Spring 3.2 based) on linux hosts. The linux hosts are vulnerable to the ShellShock vulnerability.

Can someone exploit this vulnerabiity on my website ?

Improve this question
2

1 Answer 1

Reset to default
1

This is very difficult to answer, as no one here does know how your application is built.

As long as you are not executing (either directly or indirectly) any system commands your application should be save.

There is only a risk when you execute commands (either directly or indirectly) in the shell out of your application.

This risk is very high if you execute shell commands (either directly or indirectly) that your users are entering as then your system is vulnerable.

Executing shell commands out of a Java web application is very unusual and not needed in almost all cases.

Improve this answer
2
  • Uwe : I am not running any shell commands through my Java application. As I mentioned its Spring 3.2 based. It is a user management website. Ofcourse I get the user agent, IP and other browser data, and pass it to down stream applications.
    – Novice User
    Sep 29, 2014 at 6:01
  • @NoviceUser I've extended my answer. All risk also exists if you execute such commands indirectly. As I wrote an definitive answer is difficult as nobody here knows if any commands are executed (either directly or indirectly).
    – Uwe Plonus
    Sep 29, 2014 at 6:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .