Some days ago I read about the Shellshock bug and I wanted to test a CUPS server for it and readed some example codes to build this code:

() { test;};echo /"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd' "http://anything.xy:631/printers/jobs.cgi?ORDER=asc&QUERY=123&x=0&y=0

I've inserted it to a custom Firefox User Agent String and visited the cgi script.

Now something should happen but it doesn't. Does it mean, it's secure or does it mean that I made a mistake with it?

Do I have to use curl?

Thanks in advance guys :-)

  • 1
    Are you actively trying to attack a server in the wild or doing this on your own network for your own curiosity?
    – RoraΖ
    Oct 23, 2014 at 12:22
  • I don't know why anyone should provide his CUPS server in public? It's in our private network for testing reasons 'cause there are much pc's in this network. Oct 23, 2014 at 21:40

1 Answer 1


Shellshock is a vulnerability in the Bash command line interpreter. You may be vulnerable to Shellshock depending on your version of bash.

You can use bashcheck to check if your version of Bash is vulnerable to shellshock: https://github.com/hannob/bashcheck

To test whether you version of Bash or your system services are vulnerable to Shellshock manually, check out mubix's writeup: https://github.com/mubix/shellshocker-pocs

Regarding exploiting CUPS; you're doing it wrong. The CUPS HTTP server does not export HTTP headers (such as 'User-Agent' and 'Content-Type') to environment variables in the same way Apache mod_cgi does. Refer to the CUPS exploit at the link above to test if your version of CUPS is vulnerable. Note that CUPS runs on the local loopback interface by default and is not vulnerable to remote command execution unless remote access is enabled.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .