CVE-2014-6271criticalunder attackCWE-78

CVE-2014-6271

Published · Updated

Follow this CVE+ Monitor Bourne-Again Shell+ Monitor bash

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDSep 24
1st PoCSep 24
metasploitSep 24
CISA KEV+2683d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
31 products (164 components)
Red Hat Enterprise Linux (v. 5 server) · Red Hat Enterprise Linux EUS (v. 5.9 server) · Red Hat Enterprise Linux Server (v. 6) · Red Hat Enterprise Linux Server EUS (v. 6.4) · Red Hat Enterprise Linux Server Optional (v. 6) · and others 26
fix ↗
Action required by CISAfederal deadline: 2022-07-28

Apply updates per vendor instructions.

In short

Bash processes extra code hidden in environment variables, allowing attackers to run arbitrary commands on systems using vulnerable versions. This affects servers using SSH, web servers, and DHCP clients.

Technical detail

The vulnerability exists in how Bash parses function definitions in environment variables; attackers can inject arbitrary code after a function definition that executes with the privileges of the Bash process. Attack vectors include SSH forced commands, CGI scripts, and DHCP client environments across privilege boundaries. The initial patch (CVE-2014-7169) proved incomplete, leaving exploitation paths open.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 198✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34896exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34765exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34766exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/40938exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35115exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34862exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34900exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34839exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34895exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/39918exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/42938exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34777exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38849exploitdbwww.exploit-db.com/exploits/35146unverifiedexploitdbwww.exploit-db.com/exploits/36504unverifiedexploitdbwww.exploit-db.com/exploits/40619unverifiedexploitdbwww.exploit-db.com/exploits/36609unverifiedexploitdbwww.exploit-db.com/exploits/36503unverifiedexploitdbwww.exploit-db.com/exploits/37816unverifiedexploitdbwww.exploit-db.com/exploits/34879unverifiedexploitdbwww.exploit-db.com/exploits/34860unverifiedgithubgithub.com/opsxcq/exploit-CVE-2014-6271★ 232githubgithub.com/scottjpack/shellshock_scanner★ 46githubgithub.com/hmlio/vaas-cve-2014-6271★ 22githubgithub.com/b4keSn4ke/CVE-2014-6271★ 15githubgithub.com/cj1324/CGIShell★ 13githubgithub.com/francisck/shellshock-cgi★ 12githubgithub.com/indiandragon/Shellshock-Vulnerability-Scan★ 11githubgithub.com/npm/ansible-bashpocalypse★ 6githubgithub.com/P0cL4bs/ShellShock-CGI-Scan★ 6githubgithub.com/J0hnTh3Kn1ght/CVE-2014-6271★ 5githubgithub.com/K3ysTr0K3R/CVE-2014-6271-EXPLOIT★ 4githubgithub.com/akr3ch/CVE-2014-6271★ 4githubgithub.com/securusglobal/BadBash★ 4githubgithub.com/zalalov/CVE-2014-6271★ 4githubgithub.com/0x00-0x00/CVE-2014-6271★ 3githubgithub.com/akiraaisha/shellshocker-python★ 3githubgithub.com/ramnes/pyshellshock★ 2githubgithub.com/sch3m4/RIS★ 2githubgithub.com/RainMak3r/Rainstorm★ 2githubgithub.com/TheRealCiscoo/shellshock-poc★ 1githubgithub.com/themson/shellshock★ 1githubgithub.com/proclnas/ShellShock-CGI-Scan★ 1githubgithub.com/ryeyao/CVE-2014-6271_Test★ 1githubgithub.com/TheRealCiscoo/Shellshock-Exploit★ 1githubgithub.com/Any3ite/CVE-2014-6271★ 1githubgithub.com/somhm-solutions/Shell-Shock★ 1githubgithub.com/Gurguii/cgi-bin-shellshock★ 1githubgithub.com/im2sinister/CVE-2014-6271★ 1githubgithub.com/RadYio/CVE-2014-6271★ 1githubgithub.com/0xN7y/CVE-2014-6271★ 1githubgithub.com/sunnyjiang/shellshocker-android★ 1githubgithub.com/Anklebiter87/Cgi-bin_bash_Reverse★ 1githubgithub.com/gabemarshall/shocknaww★ 1githubgithub.com/APSL/salt-shellshock★ 1githubgithub.com/V3nG4mxV1p3r/Mobile-Drop-Device-SOC-Detection★ 1githubgithub.com/FREEGUY-6/dmz-security-monitoring-hardening★ 1githubgithub.com/mochizuki875/CVE-2014-6271-Apache-Debian★ 1githubgithub.com/Brandaoo/CVE-2014-6271★ 0githubgithub.com/MuirlandOracle/CVE-2014-6271-IPFire★ 0githubgithub.com/rsherstnev/CVE-2014-6271★ 0githubgithub.com/RAJMadhusankha/Shellshock-CVE-2014-6271-Exploitation-and-Analysis★ 0githubgithub.com/andres101c/Shellshock-CVE-2014-6271★ 0githubgithub.com/moften/CVE-2014-6271★ 0githubgithub.com/Pilou-Pilou/docker_CVE-2014-6271.★ 0githubgithub.com/Aruthw/CVE-2014-6271★ 0githubgithub.com/cved-sources/cve-2014-6271★ 0githubgithub.com/u20024804/bash-3.2-fixed-CVE-2014-6271★ 0githubgithub.com/Sindayifu/CVE-2019-14287-CVE-2014-6271★ 0githubgithub.com/ryancnelson/patched-bash-4.3★ 0githubgithub.com/jblaine/cookbook-bash-CVE-2014-6271★ 0githubgithub.com/teedeedubya/bash-fix-exploit★ 0githubgithub.com/internero/debian-lenny-bash_3.2.52-cve-2014-6271★ 0githubgithub.com/352926/shellshock_crawler★ 0githubgithub.com/rrreeeyyy/cve-2014-6271-spec★ 0githubgithub.com/R3fr4kt/Shocker-TJNULL-OSCP-★ 0githubgithub.com/renanvicente/puppet-shellshock★ 0githubgithub.com/ashrafzaryouh/CVE-2014-6271★ 0githubgithub.com/justzx2011/bash-up★ 0githubgithub.com/mattclegg/CVE-2014-6271★ 0githubgithub.com/ilismal/Nessus_CVE-2014-6271_check★ 0githubgithub.com/w4fz5uck5/ShockZaum-CVE-2014-6271★ 0githubgithub.com/cyberharsh/Shellbash-CVE-2014-6271★ 0githubgithub.com/DrHaitham/CVE-2014-6271-Shellshock-★ 0githubgithub.com/HevenTafese/Penetration-Testing-Walkthrough-Hacksudo-Thor★ 0githubgithub.com/FacundoMfernandez/pentesting-obioba★ 0githubgithub.com/huanlu/cve-2014-6271-huan-lu★ 0githubgithub.com/Dilith006/CVE-2014-6271★ 0githubgithub.com/kelleykong/cve-2014-6271-mengjia-kong★ 0githubgithub.com/wenyu1999/bash-shellshock★ 0githubgithub.com/anujbhan/shellshock-victim-host★ 0githubgithub.com/hanmin0512/CVE-2014-6271_pwnable★ 0githubgithub.com/ajansha/shellshock★ 0githubgithub.com/kaleth4/-CVE-2014-6271★ 0githubgithub.com/kaleth4/CVE-2014-6271★ 0githubgithub.com/villadora/CVE-2014-6271★ 0githubgithub.com/u20024804/bash-4.3-fixed-CVE-2014-6271★ 0githubgithub.com/heikipikker/shellshock-shell★ 0githubgithub.com/shawntns/exploit-CVE-2014-6271★ 0githubgithub.com/Sindadziy/cve-2014-6271★ 0githubgithub.com/rashmikadileeshara/CVE-2014-6271-Shellshock-★ 0githubgithub.com/cyberexpert111/Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report★ 0githubgithub.com/caverm/Shellshock_CVE-2014-6271★ 0githubgithub.com/mgiftson0/linux-env-vars-shellshock-lab★ 0githubgithub.com/ItzSteve04/shellshock-linux-host-hardening-lab★ 0githubgithub.com/kowshik-sundararajan/CVE-2014-6271★ 0githubgithub.com/AlissonFaoli/Shellshock★ 0githubgithub.com/YunchoHang/CVE-2014-6271-SHELLSHOCK★ 0githubgithub.com/knightc0de/Shellshock_vuln_Exploit★ 0githubgithub.com/mtaha-sec/bash-apocalypse★ 0githubgithub.com/Industri4l-H3ll-Xpl0it3rs/CVE-2014-6271-Shellshock★ 0githubgithub.com/mritunjay-k/CVE-2014-6271★ 0githubgithub.com/0xBlackash/CVE-2014-6271★ 0githubgithub.com/ambjlou/it355-lab4-enterprise-lan-security★ 0githubgithub.com/Vaibhav91one/shellshock-cve-lab★ 0githubgithub.com/woltage/CVE-2014-6271★ 0githubgithub.com/ariarijp/vagrant-shellshock★ 0githubgithub.com/CyberCTF/vulhub-bash-cve-2014-6271★ 0githubgithub.com/dlitz/bash-cve-2014-6271-fixes★ 0githubgithub.com/u20024804/bash-4.2-fixed-CVE-2014-6271★ 0githubgithub.com/FilipStudeny/-CVE-2014-6271-Shellshock-Remote-Command-Injection-★ 0vulncheckvulncheck.com/xdb/9550fc6e89edunverifiedcve_referencewww.exploit-db.com/exploits/40619/unverifiedcve_referencewww.exploit-db.com/exploits/40938/unverifiedcve_referencewww.exploit-db.com/exploits/42938/unverifiedvulncheckvulncheck.com/xdb/e150360b38d0unverifiedcve_referencepacketstormsecurity.com/files/161107/SonicWall-SSL-VPN-Shellshock-Remote-Code-Execution.htmlunverifiedcve_referencewww.exploit-db.com/exploits/34879/unverifiedcve_referencewww.exploit-db.com/exploits/37816/unverifiedcve_referencewww.exploit-db.com/exploits/38849/unverifiedcve_referencewww.exploit-db.com/exploits/39918/unverifiedvulncheckvulncheck.com/xdb/5f01521408f7unverifiedvulncheckvulncheck.com/xdb/7de685550961unverifiedvulncheckvulncheck.com/xdb/7deee0fd9deeunverifiedvulncheckvulncheck.com/xdb/06510b11bc7funverifiedvulncheckvulncheck.com/xdb/ea6ebbb2e818unverifiedvulncheckvulncheck.com/xdb/a6a6593727f9unverifiedvulncheckvulncheck.com/xdb/38bec3f859fbunverifiedvulncheckvulncheck.com/xdb/bb5d1b3fecc3unverifiedvulncheckvulncheck.com/xdb/0c87a5624456unverifiedvulncheckvulncheck.com/xdb/5df8e24bf0a1unverifiedvulncheckvulncheck.com/xdb/4d2e86dbfb5eunverifiedvulncheckvulncheck.com/xdb/b6fa067a48a7unverifiedvulncheckvulncheck.com/xdb/576415daacbaunverifiedvulncheckvulncheck.com/xdb/bf54ee1b08d5unverifiedvulncheckvulncheck.com/xdb/819c1fcf3fa1unverifiedvulncheckvulncheck.com/xdb/1b466fc06fc0unverifiedvulncheckvulncheck.com/xdb/177e5ecfe706unverifiedvulncheckvulncheck.com/xdb/b4b5de984e30unverifiedvulncheckvulncheck.com/xdb/e8cd174acc84unverifiedvulncheckvulncheck.com/xdb/fbb4b4bb3cedunverifiedvulncheckvulncheck.com/xdb/990c93705921unverifiedvulncheckvulncheck.com/xdb/95ad8f7d9c11unverifiedvulncheckvulncheck.com/xdb/04807f4a086eunverifiedvulncheckvulncheck.com/xdb/9c92078dc7f6unverifiedvulncheckvulncheck.com/xdb/f04bc714ad93unverifiedvulncheckvulncheck.com/xdb/3af8913bb29eunverifiedvulncheckvulncheck.com/xdb/91302a8a527cunverifiedvulncheckvulncheck.com/xdb/e57812c06cafunverifiedvulncheckvulncheck.com/xdb/18c86f55b23dunverifiedvulncheckvulncheck.com/xdb/462fc384771eunverifiedvulncheckvulncheck.com/xdb/fa1741b5fe55unverifiedvulncheckvulncheck.com/xdb/137b7b5051c2unverifiedvulncheckvulncheck.com/xdb/7f347ea4e4c6unverifiedvulncheckvulncheck.com/xdb/4b6744519444unverifiedvulncheckvulncheck.com/xdb/2ffa4dfd961aunverifiedvulncheckvulncheck.com/xdb/b572ab83cdb5unverifiedvulncheckvulncheck.com/xdb/8d2b021f02a5unverifiedvulncheckvulncheck.com/xdb/4a31a0cc5806unverifiedvulncheckvulncheck.com/xdb/1b15435d492funverifiedvulncheckvulncheck.com/xdb/6af12f28ca11unverifiedvulncheckvulncheck.com/xdb/87352658799bunverifiedvulncheckvulncheck.com/xdb/eb9720b691f3unverifiedvulncheckvulncheck.com/xdb/771d67861982unverifiedvulncheckvulncheck.com/xdb/ea7dfb5a79c0unverifiedvulncheckvulncheck.com/xdb/89cf85aa3c3dunverifiedvulncheckvulncheck.com/xdb/37913b9c97afunverifiedvulncheckvulncheck.com/xdb/8cb6b0e4bfd9unverifiedvulncheckvulncheck.com/xdb/a69624ba8529unverifiedvulncheckvulncheck.com/xdb/1d5c31767173unverifiedvulncheckvulncheck.com/xdb/daaa4adc42e7unverifiedvulncheckvulncheck.com/xdb/e8c47c4cdbc6unverifiedvulncheckvulncheck.com/xdb/fc729b077d75unverifiedvulncheckvulncheck.com/xdb/9267e8f27a58unverifiedvulncheckvulncheck.com/xdb/26a44b1809c1unverifiedvulncheckvulncheck.com/xdb/a4dc40b36d10unverifiedcve_referencepacketstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.htmlunverifiedcve_referencepacketstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.htmlunverifiedcve_referencepacketstormsecurity.com/files/128573/Apache-mod_cgi-Remote-Command-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/137376/IPFire-Bash-Environment-Variable-Injection-Shellshock.htmlunverifiedvulncheckvulncheck.com/xdb/a5f2b3ac9e77unverifiedvulncheckvulncheck.com/xdb/799f163f1193unverifiedvulncheckvulncheck.com/xdb/6eefe54f4c54unverifiedvulncheckvulncheck.com/xdb/909ab6e757c3unverifiedvulncheckvulncheck.com/xdb/9a279bc7adaaunverifiedvulncheckvulncheck.com/xdb/b2a3981383e1unverifiedvulncheckvulncheck.com/xdb/536bb897776bunverifiedvulncheckvulncheck.com/xdb/04b439ea4e9dunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.