4 ms·
Can someone explain why apache cgi use bash? You can of course setup an environment without bash and execute your scripts. It's just an argument to exec*() afte
by general_failure 12y ago
Can someone explain why apache cgi use bash? You can of course setup an environment without bash and execute your scripts. It's just an argument to exec*() after all.
- danielweber 12y agoAll the modern webserver<->framework interfaces don't call bash directly, but they may end up calling it indirectly in one of a dozen different ways.
- tlrobinson 12y agoAnd environment variables are typically inherited by subprocesses, so if the CGI script executes anything (that executes anything, recursively) that uses bash (including system() if /bin/sh is bash, e.x. on OS X) this bug becomes exploitable?
- ZoFreX 12y agoIt doesn't necessarily. But what it does do is pass information about the request in environment variables - that's step 1: attacker controls the contents of an environment variable. Then, if at any point the script invokes bash, or calls something like system(), exec() or popen() and has bash set as the default shell, then bash will run, with those environment variables set. That's step 2, and the server is now the attacker's.