1

I am running a java webapplication ( Spring 3.2 based) on linux hosts. The linux hosts are vulnerable to the ShellShock vulnerability.

Can someone exploit this vulnerabiity on my website ?

1

This is very difficult to answer, as no one here does know how your application is built.

As long as you are not executing (either directly or indirectly) any system commands your application should be save.

There is only a risk when you execute commands (either directly or indirectly) in the shell out of your application.

This risk is very high if you execute shell commands (either directly or indirectly) that your users are entering as then your system is vulnerable.

Executing shell commands out of a Java web application is very unusual and not needed in almost all cases.

  • Uwe : I am not running any shell commands through my Java application. As I mentioned its Spring 3.2 based. It is a user management website. Ofcourse I get the user agent, IP and other browser data, and pass it to down stream applications. – Novice User Sep 29 '14 at 6:01
  • @NoviceUser I've extended my answer. All risk also exists if you execute such commands indirectly. As I wrote an definitive answer is difficult as nobody here knows if any commands are executed (either directly or indirectly). – Uwe Plonus Sep 29 '14 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.