I am running a java webapplication ( Spring 3.2 based) on linux hosts. The linux hosts are vulnerable to the ShellShock vulnerability.
Can someone exploit this vulnerabiity on my website ?
This is very difficult to answer, as no one here does know how your application is built.
As long as you are not executing (either directly or indirectly) any system commands your application should be save.
There is only a risk when you execute commands (either directly or indirectly) in the shell out of your application.
This risk is very high if you execute shell commands (either directly or indirectly) that your users are entering as then your system is vulnerable.
Executing shell commands out of a Java web application is very unusual and not needed in almost all cases.