CVE-2014-7169
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 49 threat group(s) use it.
ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDSep 25
1st PoCSep 25
CISA KEV+2682d
Who exploits it — 49
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
APT / StateAgrius🇮🇷 MITRE ATT&CK
APT / StateAPT28🇷🇺 MITRE ATT&CK
APT / StateAPT29🇷🇺 MITRE ATT&CK
APT / StateAPT39🇮🇷 MITRE ATT&CK
APT / StateAPT41🇨🇳 MITRE ATT&CK
APT / StateAPT5🇨🇳 MITRE ATT&CK
APT / StateAxiom🇨🇳 MITRE ATT&CK
APT / StateBackdoorDiplomacy MITRE ATT&CK
RansomwareBlackByte MITRE ATT&CK
APT / StateBlackTech🇨🇳 MITRE ATT&CK
APT / StateBlue Mockingbird MITRE ATT&CK
APT / StateCinnamon Tempest🇨🇳 MITRE ATT&CK
APT / StateDragonfly🇷🇺 MITRE ATT&CK
APT / StateEarth Lusca🇨🇳 MITRE ATT&CK
APT / StateEmber Bear🇷🇺 MITRE ATT&CK
APT / StateFIN13 MITRE ATT&CK
APT / StateFIN7 MITRE ATT&CK
APT / StateFox Kitten🇮🇷 MITRE ATT&CK
APT / StateGALLIUM🇨🇳 MITRE ATT&CK
APT / StateGOLD SOUTHFIELD MITRE ATT&CK
APT / StateHAFNIUM🇨🇳 MITRE ATT&CK
APT / StateINC Ransom MITRE ATT&CK
APT / StateKe3chang🇨🇳 MITRE ATT&CK
APT / StateKimsuky🇰🇵 MITRE ATT&CK
APT / StateLeviathan🇨🇳 MITRE ATT&CK
APT / StateMagic Hound🇮🇷 MITRE ATT&CK
APT / StateMedusa Group MITRE ATT&CK
APT / StatemenuPass🇨🇳 MITRE ATT&CK
APT / StateMirrorFace🇨🇳 MITRE ATT&CK
APT / StateMoses Staff🇮🇷 MITRE ATT&CK
APT / StateMuddyWater🇮🇷 MITRE ATT&CK
RansomwarePlay MITRE ATT&CK
APT / StateRocke🇨🇳 MITRE ATT&CK
APT / StateSalt Typhoon🇨🇳 MITRE ATT&CK
APT / StateSandworm Team🇷🇺 MITRE ATT&CK
APT / StateSea Turtle MITRE ATT&CK
RansomwareShinyHunters MITRE ATT&CK
APT / StateStorm-0501 MITRE ATT&CK
APT / StateTeamPCP MITRE ATT&CK
APT / StateThe Gentlemen MITRE ATT&CK
APT / StateThreat Group-3390🇨🇳 MITRE ATT&CK
APT / StateToddyCat MITRE ATT&CK
APT / StateTonto Team🇨🇳 MITRE ATT&CK
APT / StateUNC3886🇨🇳 MITRE ATT&CK
APT / StateVOID MANTICORE🇮🇷 MITRE ATT&CK
APT / StateVolatile Cedar MITRE ATT&CK
APT / StateVolt Typhoon🇨🇳 MITRE ATT&CK
APT / StateWinter Vivern🇷🇺 MITRE ATT&CK
APT / StateWizard Spider🇷🇺 MITRE ATT&CK
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Fixed
32 products (171 components)
Red Hat Enterprise Linux (v. 5 server) · Red Hat Enterprise Linux EUS (v. 5.9 server) · Red Hat Enterprise Linux Server (v. 6) · Red Hat Enterprise Linux Server EUS (v. 6.4) · Red Hat Enterprise Linux Server Optional (v. 6) · and others 27
Action required by CISAfederal deadline: 2022-07-28
Apply updates per vendor instructions.
In short
Bash processes commands hidden after function definitions in environment variables, allowing attackers to execute arbitrary code when Bash runs with elevated privileges. This is a critical flaw because many systems use environment variables to pass data to programs.
Technical detail
CWE-78 OS command injection via environment variable processing. GNU Bash ≤4.3 fails to properly parse function definitions, permitting arbitrary command execution in trailing strings when environment variables cross privilege boundaries (e.g., sshd ForceCommand, Apache CGI, DHCP clients). Incomplete remediation of CVE-2014-6271 leaves the injection vector partially functional.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 25✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34896exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34777exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35115exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34895exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34839exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34766exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34765exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34862exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/36933exploitdbwww.exploit-db.com/exploits/36609unverifiedexploitdbwww.exploit-db.com/exploits/36504unverifiedexploitdbwww.exploit-db.com/exploits/35146unverifiedexploitdbwww.exploit-db.com/exploits/34879unverifiedexploitdbwww.exploit-db.com/exploits/34860unverifiedexploitdbwww.exploit-db.com/exploits/36503unverifiedgithubgithub.com/chef-boneyard/bash-shellshock★ 5githubgithub.com/Gobinath-B/SHELL-SCHOCK★ 1githubgithub.com/gina-alaska/bash-cve-2014-7169-cookbook★ 0githubgithub.com/Kushiro45/shellshock-poc-cve-2014-7169★ 0cve_referencepacketstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.htmlunverifiedvulncheckvulncheck.com/xdb/763bd04b8e06unverifiedvulncheckvulncheck.com/xdb/4198cdfc661funverifiedvulncheckvulncheck.com/xdb/a74476a1777funverifiedcve_referencepacketstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.htmlunverifiedcve_referencewww.exploit-db.com/exploits/34879/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://advisories.mageia.org/MGASA-2014-0393.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlhttp://jvndb.jvn.jp/jvndb/JVNDB-2014-000126http://jvn.jp/en/jp/JVN55667175/index.htmlhttp://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.htmlhttp://linux.oracle.com/errata/ELSA-2014-1306.htmlhttp://linux.oracle.com/errata/ELSA-2014-3075.htmlhttp://linux.oracle.com/errata/ELSA-2014-3077.htmlhttp://linux.oracle.com/errata/ELSA-2014-3078.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html