Can you give an example of an exploit in bash? The link you give is excellent information, but doesn't have any shell script examples. My first thought: It see

Can you give an example of an exploit in bash? The link you give is excellent information, but doesn't have any shell script examples. My first thought: It seems like only $@, $* and variables read from the environment could be possible attack vectors. But since shell scripts can't be setuid, it's hard for me to immediately imagine how unquoting could enable a new exploit. EDIT: the most dangerous example I can think of right now is a script like this, where a webapp invokes the script and passes a GET param as an argument: #!/bin/bash exec $1 But if I execute this like so: ./badscript.sh 'some-benign-command ; cat /etc/passwd' ... then passwd is not exposed, because the tokens ";", "cat" and "/etc/passwd" are passed into the argv of some-benign-command. (And if "cat /etc/password" itself can be passed as $1, then quoting won't help...)