Shellshock

Description

Check for Shellshock vulnerabilities.

Remediation

Shellshock vulnerability takes advantage of a bug in BASH, in which BASH incorrectly executes trailing commands when it imports a function definition stored into an environment variable. Any environment which allows defining BASH environment variables could be vulnerable to this bug, as for example an Apache Web Server using mod_cgi and mod_cgid modules. A known-good request was modified to include malicious content. The malicious content includes a Shellshock attack in which the server-side application returns a specific text (evidence) in the response headers.

Links

• OWASP
• CWE