3 ms·
That was my initial reaction too, but I'm not so sure now that the bash maintainer has responded. I'm trying to get a better PoC working. edit: OK, I give. I d
by thaumaturgy 12y ago
That was my initial reaction too, but I'm not so sure now that the bash maintainer has responded. I'm trying to get a better PoC working.
edit: OK, I give. I don't understand how this is different from,
env z='' echo oops
So, assuming you have Stupid Server 2.0, and SS 2.0 allows you to send an Accept: header with,
'' evil command here
...you still need to find a way to execute that command, which is different from CVE-2014-6271, which caused function embedded in environment variables to be executed when they were read.
Am I missing something?
- timv 12y agoAm I missing something? I think so, but the sample exploit isn't really designed to give a clear understanding if you don't already know what's going on. Try this: $ export X="() { (a)=>\\" $ bash -c 'echo date' bash: X: line 1: syntax error near unexpected token `=' bash: X: line 1: `' bash: error importing function definition for `X' $ cat echo Thu Sep 25 02:27:07 UTC 2014 Setting "X" in that way confuses the bash env variable parser. It barfs at the "=" and leaves the ">\" unparsed AFAICT (without digging deep into the code) that leave in the execution buffer as ">\[NEWLINE]echo date" which gets treated the same as date > echo
- thaumaturgy 12y agoOh that's neat.