Shellshock used in CUPS

Question

Some days ago I read about the Shellshock bug and I wanted to test a CUPS server for it and readed some example codes to build this code:

() { test;};echo /"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd' "http://anything.xy:631/printers/jobs.cgi?ORDER=asc&QUERY=123&x=0&y=0

I've inserted it to a custom Firefox User Agent String and visited the cgi script.

Now something should happen but it doesn't. Does it mean, it's secure or does it mean that I made a mistake with it?

Do I have to use curl?

Thanks in advance guys :-)

Answer 1

Shellshock is a vulnerability in the Bash command line interpreter. You may be vulnerable to Shellshock depending on your version of bash.

You can use bashcheck to check if your version of Bash is vulnerable to shellshock: https://github.com/hannob/bashcheck

To test whether you version of Bash or your system services are vulnerable to Shellshock manually, check out mubix's writeup: https://github.com/mubix/shellshocker-pocs

Regarding exploiting CUPS; you're doing it wrong. The CUPS HTTP server does not export HTTP headers (such as 'User-Agent' and 'Content-Type') to environment variables in the same way Apache mod_cgi does. Refer to the CUPS exploit at the link above to test if your version of CUPS is vulnerable. Note that CUPS runs on the local loopback interface 127.0.0.1 by default and is not vulnerable to remote command execution unless remote access is enabled.