0

i've see a lot of different webserver-attacks against cgi-pages, but have seen the malicious payload only in the headers, might it be

  • User-Agent
  • Cookies
  • Referer
  • Custom-Headers

does anyone know if (or if not) one might use POST-Vars or other methods to inject the payload?

3 Answers 3

2

In a CGI request, the POST or PUT data is passed via standard input, not an environment variable. Consequently, it can only be used as an attack vector if the CGI program being attacked specifically places all or part of the data in an environment variable before running bash -- something that's extremely rare for CGI programs to do.

4

For Apache, the HTTP protocol is also a vector:

A request like:

GET /some/cgi () {(:);};xxx

Will put () {(:);};xxx in the SERVER_PROTOCOL environment variable.

So, to detect, it's important to look for the () { string anywhere in the request header, not only after a :\s*.

Also, it's conceivable that a base64 user name in a Authorization header end up in an environment variable for some authentication module.

It's conceivable that QUERYSTRING or PATH_INFO be a vector with some web server implementations (not Apache AFAICT).

2
  • wouldnt apache render this request illegit (Status 400)? nginx does this, iirc Commented Oct 7, 2014 at 6:29
  • 1
    @thatguyfromoverthere, I'd agree it probably should, but apache doesn't (at least not in the versions I tried). That first line can contain anything, the first word is the method, the second the path and the rest, if any the protocol (SERVER_PROTOCOL defaults to HTTP/0.9 when not provided probably for compatibility with servers from the early 90s). Commented Oct 7, 2014 at 8:32
1

As GET data is passed via the environment variable in CGI request, that's why the shellshock attack uses HTTP GET request header to trigger the attack. There are other attack vectors are also possible to execute the attack like DHCP. In this, attacker can exploit the vulnerability by interacting with application that uses BASH environment variables and whose content is determined by the Input read from the network such as DHCP. To successfully exploit this vulnerability attacker has to control the value of environment variable. As we know the DHCP is used to assign the dynamic IPs, server address etc to the client. So to exploit this vulnerability an attacker need to be in the same network and act as DHCP server. The scenario will be like

**The client broadcasts DHCP Discover message:

[ Attacker ] <-------------------- [ Target ]

The attacker sends a crafted DHCP Offer message to the target:

[ Attacker ] --------------------> [ Target ]

The client sends DHCP Request message to attacker:

[ Attacker ] <-------------------- [ Target ]

The attacker sends a crafted DHCP ACK message to the target:

[ Attacker ] --------------------> [ Target ]**

The attacker can embed the BASH environment variable in the DHCP option field of DHCP Offer or DHCP ACK.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .