GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Exploited since 2022-01-28. 3 of 8 rule sources name it. Our CRS test: blocked.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the… More
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Edge coverage
Claimed by vendorsAsk Vigil
AI · answers from this pageWorkers AI (Llama 3.3). Can be wrong: check the cited source.
Severity, decoded
CVSS 3.1Exploitable over the network, with no privileges and no user interaction, leading to full loss of confidentiality, integrity and availability.
How the score is built
- Attack vectorAn attacker can reach it over the internet; no access to your network needed.Network
- Attack complexityNo special conditions are needed; the attack works reliably.Low
- Privileges requiredNo account or login is needed.None
- User interactionNo one has to click or open anything; the attack works on its own.None
- ScopeThe damage stays within the vulnerable component.Unchanged
- Confidentiality impactAn attacker can read all data the affected component holds, or the most sensitive parts of it.High
- Integrity impactAn attacker can change any data or files the affected component protects.High
- Availability impactAn attacker can take the component down completely or keep it from serving anyone.High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAttackers are exploiting this in the wild.
Attackers can script the attack end to end and hit many targets at once.
A successful attack gives full control over the affected software or all of its data.
Public exploits
13 found- MetasploitAdvantech Switch Bash Environment Variable Code Injection (Shellshock)2015-12-01 · exploit · rank Excellent · has check
- MetasploitIPFire Bash Environment Variable Injection (Shellshock)2014-09-29 · exploit · rank Excellent · has check
- MetasploitApache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner2014-09-24 · auxiliary · rank Normal · has check
- MetasploitDHCP Client Bash Environment Variable Code Injection (Shellshock)2014-09-24 · auxiliary · rank Normal
- MetasploitPure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)2014-09-24 · exploit · rank Excellent · has check
- MetasploitApache mod_cgi Bash Environment Variable Code Injection (Shellshock)2014-09-24 · exploit · rank Excellent · has check
- MetasploitCUPS Filter Bash Environment Variable Code Injection (Shellshock)2014-09-24 · exploit · rank Excellent · has check
- MetasploitOS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection (Shellshock)2014-09-24 · exploit · rank Normal · has check
- MetasploitDhclient Bash Environment Variable Injection (Shellshock)2014-09-24 · exploit · rank Excellent
- MetasploitQmail SMTP Bash Environment Variable Injection (Shellshock)2014-09-24 · exploit · rank Normal
- Exploit-DBQmail SMTP - Bash Environment Variable Injection (Metasploit)2017-10-02 · remote · linux · verified
- Exploit-DBRedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection2016-12-18 · local · linux · verified
- NucleiCVE-2014-6271.yamldetection template, replayed in our lab
Links are to third-party code: never run it outside an isolated lab.
Timeline
- 2014-09-24CVE publishedCVE List
- 2014-09-24Metasploit module publishedApache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner
- 2016-12-18Exploit published on Exploit-DBRedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection
- 2022-01-28Added to CISA KEVConfirmed exploitation in the wild
- 2023-08-08F5 rule names itEarliest entry we can see is an update
- 2026-11-02Our test: OWASP Core Rule Set blocked itparanoia level 1, anomaly threshold 5, default CRS settings
- 2026-11-02Our test: OWASP Core Rule Set blocked itparanoia level 2, anomaly threshold 5, default CRS settings
Vendor statements
QuotedCloudflareWAF Managed Rules
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
AWSAWS WAF Managed Rules
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
Microsoft AzureFront Door and Application Gateway WAF (DRS)
Rule 932170: Critical - 5 · 1 · Remote Command Execution: Shellshock (CVE-2014-6271)
Rule 932171: Critical - 5 · 1 · Remote Command Execution: Shellshock (CVE-2014-6271)
Google CloudCloud Armor preconfigured WAF rules
Signature owasp-crs-v042200-id932170-rce (sensitivity 1): Remote command execution: shellshock (CVE-2014-6271)
Signature owasp-crs-v042200-id932171-rce (sensitivity 1): Remote command execution: shellshock (CVE-2014-6271)
Signature owasp-crs-v030301-id932170-rce (sensitivity 1): Shellshock (CVE-2014-6271)
Signature owasp-crs-v030301-id932171-rce (sensitivity 1): Shellshock (CVE-2014-6271)
Signature owasp-crs-v030001-id932170-rce (sensitivity 1): Shellshock (CVE-2014-6271)
Signature owasp-crs-v030001-id932171-rce (sensitivity 1): Shellshock (CVE-2014-6271)
FastlyNext-Gen WAF virtual patches
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
F5Attack signatures (Distributed Cloud WAF)
Named by 2023-08-08; the first entry is an update, so the rule may be older.
Updated: signature 200003927 "Bash Shellshock execution attempt (2)" (Command Execution, risk High), systems: Unix/Linux. References: CVE-2014-6271, CVE-2014-7169, CVE-2014-6277, CVE-2014-6278.
AkamaiApp & API Protector (Adaptive Security Engine)
This vendor publishes no machine-readable rule changelog we can check.
OWASP CRSCore Rule Set (open source, used inside many WAFs)
The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.
Social
No posts seen yet on X, Bluesky, Mastodon, Hacker News or GitHub.