4 ms·
All the modern webserver<->framework interfaces don't call bash directly, but they may end up calling it indirectly in one of a dozen different ways.
by danielweber 12y ago
All the modern webserver<->framework interfaces don't call bash directly, but they may end up calling it indirectly in one of a dozen different ways.
- tlrobinson 12y agoAnd environment variables are typically inherited by subprocesses, so if the CGI script executes anything (that executes anything, recursively) that uses bash (including system() if /bin/sh is bash, e.x. on OS X) this bug becomes exploitable?