On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses bash as an interpreter on the vulnerable system. Am I right in this understanding and does this actually limit the scope of this vulnerability? Also, does the attacker have to enumerate pages on the vulnerable system to get at a vulnerable cgi script eventually or is there other known methods?
the exact cgi script which uses bash as an interpreter
"Using bash as an interpreter" not a precondition for the exploitation of the family of bash vulnerabilities called "shellshock" (the many distinct parsing vulnerabilities based on an environment variable with any name beginning with exactly the bytes
All you need to exploit one of "shellshock" vuln is to run the bash program with one user-controlled value of an environment variable; a shell script with bash as a shell interpreter (
/bin/sh is a link to
bash) is one obvious way to run bash, but many others exist when
/bin/sh is bash: many function calls which run an external program take a string command (not a path and an array of arguments); notably
popen (unlike the
exec* family of functions). These functions taking a string use the default shell (
/bin/sh) to parse the command string, so the use of these functions makes the program vulnerable to bash vulnerabilities, unless the environment has been cleaned up from any user input.
So any C program using these functions is potentially vulnerable. And programs written in other programming languages with similar functions.
This is a lot more programs than just
Of course, a C program can
exec an executable file that happens to be a shell script with a
/bin/bash interpreter, too.
exact cgi script which uses bash
Please note that a "cgi script" can actually be any program with the CGI interface; it does not need to be a "script" as in shell script. Often, CGI "scripts" are written in compiled languages, like C.
Also, does the attacker have to enumerate pages on the vulnerable system
Many CGI scripts are in well known, fixed, locations, on most installations.