4 ms·
Yes. I've seen attempts to exploit bash via http headers (the headers them selves). Like so: GET / HTTP/1.1\r\n Host: () { :;}; echo vulnerable\r\n User-Agent:
by SCHiM 12y ago
Yes. I've seen attempts to exploit bash via http headers (the headers them selves). Like so:
GET / HTTP/1.1\r\n
Host: () { :;}; echo vulnerable\r\n
User-Agent: () () { :;}; echo vulnerable\r\n\r\n
So even static servers could have been vulnerable. I'm not sure if your server was vulnerable or not, but I think you were definitely too soon with assuming you were safe.
- tokenizerrr 12y agoThis exploit only works if bash is called at all during the handling of the request. This is typically only the case with CGI scripts, or when the requested application does a system() call or directly calls out to bash
- SCHiM 12y agoThough it should certainly not happen, it's not uncommon for various applications to 'shell-out' certain tasks. The point I was trying to make is that you're not necessarily secure just because you don't use CGI or only host static content, and that exploitation via the web server could certainly have been possible.