← back
CVE-2014-6271

CVE-2014-6271

CVSS 9.8 CRITICALEPSS 100.0%● KEVCWE-78
In short

Bash processes extra code hidden in environment variables, allowing attackers to run arbitrary commands on systems using vulnerable versions. This affects servers using SSH, web servers, and DHCP clients.

Technical detail

The vulnerability exists in how Bash parses function definitions in environment variables; attackers can inject arbitrary code after a function definition that executes with the privileges of the Bash process. Attack vectors include SSH forced commands, CGI scripts, and DHCP client environments across privilege boundaries. The initial patch (CVE-2014-7169) proved incomplete, leaving exploitation paths open.

Summary generated and translated by AI from the official description.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 123
githubgithub.com/opsxcq/exploit-CVE-2014-6271★ 232githubgithub.com/scottjpack/shellshock_scanner★ 46githubgithub.com/hmlio/vaas-cve-2014-6271★ 22githubgithub.com/b4keSn4ke/CVE-2014-6271★ 15githubgithub.com/cj1324/CGIShell★ 13githubgithub.com/francisck/shellshock-cgi★ 12githubgithub.com/indiandragon/Shellshock-Vulnerability-Scan★ 11githubgithub.com/npm/ansible-bashpocalypse★ 6githubgithub.com/P0cL4bs/ShellShock-CGI-Scan★ 6githubgithub.com/zalalov/CVE-2014-6271★ 4githubgithub.com/securusglobal/BadBash★ 4githubgithub.com/akr3ch/CVE-2014-6271★ 4githubgithub.com/akiraaisha/shellshocker-python★ 3githubgithub.com/K3ysTr0K3R/CVE-2014-6271-EXPLOIT★ 3githubgithub.com/0x00-0x00/CVE-2014-6271★ 3githubgithub.com/ramnes/pyshellshock★ 2githubgithub.com/sch3m4/RIS★ 2githubgithub.com/RainMak3r/Rainstorm★ 2githubgithub.com/0xN7y/CVE-2014-6271★ 1githubgithub.com/im2sinister/CVE-2014-6271★ 1githubgithub.com/Gurguii/cgi-bin-shellshock★ 1githubgithub.com/sunnyjiang/shellshocker-android★ 1githubgithub.com/TheRealCiscoo/Shellshock-Exploit★ 1githubgithub.com/gabemarshall/shocknaww★ 1githubgithub.com/RadYio/CVE-2014-6271★ 1githubgithub.com/mochizuki875/CVE-2014-6271-Apache-Debian★ 1githubgithub.com/themson/shellshock★ 1githubgithub.com/Anklebiter87/Cgi-bin_bash_Reverse★ 1githubgithub.com/somhm-solutions/Shell-Shock★ 1githubgithub.com/APSL/salt-shellshock★ 1githubgithub.com/ryeyao/CVE-2014-6271_Test★ 1githubgithub.com/Any3ite/CVE-2014-6271★ 1githubgithub.com/proclnas/ShellShock-CGI-Scan★ 1githubgithub.com/teedeedubya/bash-fix-exploit★ 0githubgithub.com/dlitz/bash-cve-2014-6271-fixes★ 0githubgithub.com/ryancnelson/patched-bash-4.3★ 0githubgithub.com/jblaine/cookbook-bash-CVE-2014-6271★ 0githubgithub.com/rrreeeyyy/cve-2014-6271-spec★ 0githubgithub.com/justzx2011/bash-up★ 0githubgithub.com/mattclegg/CVE-2014-6271★ 0githubgithub.com/ilismal/Nessus_CVE-2014-6271_check★ 0githubgithub.com/woltage/CVE-2014-6271★ 0githubgithub.com/ariarijp/vagrant-shellshock★ 0githubgithub.com/villadora/CVE-2014-6271★ 0githubgithub.com/internero/debian-lenny-bash_3.2.52-cve-2014-6271★ 0githubgithub.com/u20024804/bash-3.2-fixed-CVE-2014-6271★ 0githubgithub.com/u20024804/bash-4.2-fixed-CVE-2014-6271★ 0githubgithub.com/u20024804/bash-4.3-fixed-CVE-2014-6271★ 0githubgithub.com/renanvicente/puppet-shellshock★ 0githubgithub.com/352926/shellshock_crawler★ 0githubgithub.com/kelleykong/cve-2014-6271-mengjia-kong★ 0githubgithub.com/huanlu/cve-2014-6271-huan-lu★ 0githubgithub.com/Pilou-Pilou/docker_CVE-2014-6271.★ 0githubgithub.com/heikipikker/shellshock-shell★ 0githubgithub.com/cved-sources/cve-2014-6271★ 0githubgithub.com/shawntns/exploit-CVE-2014-6271★ 0githubgithub.com/Sindadziy/cve-2014-6271★ 0githubgithub.com/wenyu1999/bash-shellshock★ 0githubgithub.com/Sindayifu/CVE-2019-14287-CVE-2014-6271★ 0githubgithub.com/rashmikadileeshara/CVE-2014-6271-Shellshock-★ 0githubgithub.com/Dilith006/CVE-2014-6271★ 0githubgithub.com/cyberharsh/Shellbash-CVE-2014-6271★ 0githubgithub.com/MuirlandOracle/CVE-2014-6271-IPFire★ 0githubgithub.com/anujbhan/shellshock-victim-host★ 0githubgithub.com/FilipStudeny/-CVE-2014-6271-Shellshock-Remote-Command-Injection-★ 0githubgithub.com/mritunjay-k/CVE-2014-6271★ 0githubgithub.com/Brandaoo/CVE-2014-6271★ 0githubgithub.com/hanmin0512/CVE-2014-6271_pwnable★ 0githubgithub.com/AlissonFaoli/Shellshock★ 0githubgithub.com/ajansha/shellshock★ 0githubgithub.com/YunchoHang/CVE-2014-6271-SHELLSHOCK★ 0githubgithub.com/moften/CVE-2014-6271★ 0githubgithub.com/knightc0de/Shellshock_vuln_Exploit★ 0githubgithub.com/rsherstnev/CVE-2014-6271★ 0githubgithub.com/RAJMadhusankha/Shellshock-CVE-2014-6271-Exploitation-and-Analysis★ 0githubgithub.com/DrHaitham/CVE-2014-6271-Shellshock-★ 0githubgithub.com/mtaha-sec/bash-apocalypse★ 0githubgithub.com/andres101c/Shellshock-CVE-2014-6271★ 0githubgithub.com/Industri4l-H3ll-Xpl0it3rs/CVE-2014-6271-Shellshock★ 0githubgithub.com/0xBlackash/CVE-2014-6271★ 0githubgithub.com/ambjlou/it355-lab4-enterprise-lan-security★ 0githubgithub.com/kaleth4/-CVE-2014-6271★ 0githubgithub.com/kaleth4/CVE-2014-6271★ 0githubgithub.com/V3nG4mxV1p3r/Mobile-Drop-Device-SOC-Detection★ 0githubgithub.com/HevenTafese/Penetration-Testing-Walkthrough-Hacksudo-Thor★ 0githubgithub.com/FacundoMfernandez/pentesting-obioba★ 0githubgithub.com/R3fr4kt/Shocker-TJNULL-OSCP-★ 0githubgithub.com/kowshik-sundararajan/CVE-2014-6271★ 0githubgithub.com/w4fz5uck5/ShockZaum-CVE-2014-6271★ 0githubgithub.com/Aruthw/CVE-2014-6271★ 0cve_referencepacketstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.htmlunverifiedexploitdbwww.exploit-db.com/exploits/40619unverifiedexploitdbwww.exploit-db.com/exploits/40938unverifiedexploitdbwww.exploit-db.com/exploits/34900unverifiedexploitdbwww.exploit-db.com/exploits/34766unverifiedexploitdbwww.exploit-db.com/exploits/35115unverifiedexploitdbwww.exploit-db.com/exploits/34765unverifiedexploitdbwww.exploit-db.com/exploits/34860unverifiedexploitdbwww.exploit-db.com/exploits/34879unverifiedcve_referencewww.exploit-db.com/exploits/42938/unverifiedcve_referencewww.exploit-db.com/exploits/40938/unverifiedexploitdbwww.exploit-db.com/exploits/34896unverifiedexploitdbwww.exploit-db.com/exploits/34862unverifiedexploitdbwww.exploit-db.com/exploits/42938unverifiedcve_referencepacketstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.htmlunverifiedcve_referencewww.exploit-db.com/exploits/40619/unverifiedcve_referencewww.exploit-db.com/exploits/39918/unverifiedcve_referencewww.exploit-db.com/exploits/38849/unverifiedcve_referencewww.exploit-db.com/exploits/37816/unverifiedexploitdbwww.exploit-db.com/exploits/37816unverifiedexploitdbwww.exploit-db.com/exploits/36609unverifiedexploitdbwww.exploit-db.com/exploits/35146unverifiedexploitdbwww.exploit-db.com/exploits/38849unverifiedexploitdbwww.exploit-db.com/exploits/34777unverifiedcve_referencewww.exploit-db.com/exploits/34879/unverifiedexploitdbwww.exploit-db.com/exploits/39918unverifiedexploitdbwww.exploit-db.com/exploits/34895unverifiedcve_referencepacketstormsecurity.com/files/161107/SonicWall-SSL-VPN-Shellshock-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/137376/IPFire-Bash-Environment-Variable-Injection-Shellshock.htmlunverifiedcve_referencepacketstormsecurity.com/files/128573/Apache-mod_cgi-Remote-Command-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/34839unverifiedexploitdbwww.exploit-db.com/exploits/36503unverifiedexploitdbwww.exploit-db.com/exploits/36504unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://www.exploit-db.com/exploits/37816/http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00034.htmlhttp://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897http://www-01.ibm.com/support/docview.wss?uid=swg21685749http://marc.info/?l=bugtraq&m=141577137423233&w=2http://marc.info/?l=bugtraq&m=142719845423222&w=2https://www.exploit-db.com/exploits/39918/http://marc.info/?l=bugtraq&m=141216668515282&w=2http://rhn.redhat.com/errata/RHSA-2014-1295.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00037.htmlhttps://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/