3 ms·

So if you don't run CGI nor run a system command within your code, are you fairly safe? If you do have some gem that runs a system cmd, wouldn't it still requi

by chrisan 12y ago

So if you don't run CGI nor run a system command within your code, are you fairly safe? If you do have some gem that runs a system cmd, wouldn't it still require url input to get passed down to that command? I'm not advocating NOT upgrading your systems, but still fuzzy on the attack vector if this test requires I upload a cgi script

schwag09 12y ago
No, DHCP has been proven vulnerable on some systems. So, a system can be exploited by this bug just by connecting to a LAN (e.g. wifi network). Any protocol or service that runs via BASH is vulnerable. CGI is currently the largest and easiest attack vector to test for.
- brador 12y ago
  So assuming it's an online EC2 server LAMP stack with an empty cgi folder and a lone html page with hello world. Is that vulnerable to this exploit?
  - tych0 12y ago
    Yes.
    - hnha 12y ago
      remotely? how?