I was wondering why Shellshock works when put in the useragent.

Based on what I could find it is because a web server (e.g Apache) uses the useragent string in its internal working.

  1. Why would a webserver care about the useragent? AFAIK decisions based on useragent are made in the application with the programmer building the logic like if (mobile) : show mobile version etc.
  2. Why would the webserver use an Environment Variable to handle this?! couldn't this be done through regular variable-value form with enough sanitization on the input? As far as I know env-vars are not bash exclusive, they are defined in a system wide scope. I still don't get the connection!

1 Answer 1


A webserver could use the contents of the User-Agent header for logging purposes, to control access ("deny all bots") or return alternative responses ("mobile-friendly pages"). The validity of a header value depends on the application, it is not possible to write on rule that works with everything.

Consider the Cookie header. One site could purely use it to store a session identifier such as sessionid=01234567890abcdef. A different site might choose to store locales, such as lang=nl-NL. You could apply a character blacklist, but then someone might exploit a bug in your application which results in lang=--help being treated as an command-line option.

For CGI programs, web browsers will usually invoke the script and pass headers via environment variables such that the script can use this information as well. This is not limited to the User-Agent header, the values of Cookie might be more interesting for the script. The "form input" as you describe is different from the headers. Headers come before the message body.

Now about the Bash bug that leads to the "Shellshock" security issue, all you need is control over at least one environment variable. As you can see, direct CGI access on a webserver is one example where that condition is satisfied. You could also be affected when the program (PHP, Cgit, ...) invokes the shell, directly (via a shell script) or indirectly (via a shell command).

  • 1
    That was convincing. Would you please post some references which you have used to make this conclusion?
    – Sam
    Nov 18, 2014 at 9:59
  • @Sam Done, let me know if anything if you still have any questions.
    – Lekensteyn
    Nov 18, 2014 at 15:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .