1

On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses bash as an interpreter on the vulnerable system. Am I right in this understanding and does this actually limit the scope of this vulnerability? Also, does the attacker have to enumerate pages on the vulnerable system to get at a vulnerable cgi script eventually or is there other known methods?

2

the exact cgi script which uses bash as an interpreter

"Using bash as an interpreter" not a precondition for the exploitation of the family of bash vulnerabilities called "shellshock" (the many distinct parsing vulnerabilities based on an environment variable with any name beginning with exactly the bytes () {).

All you need to exploit one of "shellshock" vuln is to run the bash program with one user-controlled value of an environment variable; a shell script with bash as a shell interpreter (#!/bin/bash or #!/bin/sh where /bin/sh is a link to bash) is one obvious way to run bash, but many others exist when /bin/sh is bash: many function calls which run an external program take a string command (not a path and an array of arguments); notably system and popen (unlike the exec* family of functions). These functions taking a string use the default shell (/bin/sh) to parse the command string, so the use of these functions makes the program vulnerable to bash vulnerabilities, unless the environment has been cleaned up from any user input.

So any C program using these functions is potentially vulnerable. And programs written in other programming languages with similar functions.

This is a lot more programs than just /bin/bash scripts.

Of course, a C program can exec an executable file that happens to be a shell script with a /bin/bash interpreter, too.

exact cgi script which uses bash

Please note that a "cgi script" can actually be any program with the CGI interface; it does not need to be a "script" as in shell script. Often, CGI "scripts" are written in compiled languages, like C.

Also, does the attacker have to enumerate pages on the vulnerable system

Many CGI scripts are in well known, fixed, locations, on most installations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.