3 ms·
How are you testing it? If you're just pasting one of the proof-of-concept lines into zsh, such as this one: env x='() { :;}; echo vulnerable' bash -c "ech
by ckuehl 12y ago
How are you testing it? If you're just pasting one of the proof-of-concept lines into zsh, such as this one:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
...then you're really just executing bash. Replace "bash" in the line above with "zsh" and the "vulnerable" line is not printed.
- adamtj 12y agoNo, it's not printed in your trivial example, but if you replace the simple "echo" command with any bash script, or any executable that calls a bash script, or any executable that invokes another program that calls a bash script, or ... then you're screwed. Even with the "zsh", this should print "vulnerable": env x='() { :;}; echo vulnerable' zsh -c "bash -c true" You don't have to use bash explicitly. It might be called by some application or library. For example, if your default shell is a bash, this will work too: env x='() { :;}; echo vulnerable' zsh -c "python -c 'import os; os.system(\"true\")'"
- ckuehl 12y agoRight, the point being that bash is vulnerable, not zsh (as was suggested by the post I was replying to). I'm not claiming that using zsh as your interactive shell somehow makes you immune.