2 ms·
This exploit only works if bash is called at all during the handling of the request. This is typically only the case with CGI scripts, or when the requested app
by tokenizerrr 12y ago
This exploit only works if bash is called at all during the handling of the request. This is typically only the case with CGI scripts, or when the requested application does a system() call or directly calls out to bash
- SCHiM 12y agoThough it should certainly not happen, it's not uncommon for various applications to 'shell-out' certain tasks. The point I was trying to make is that you're not necessarily secure just because you don't use CGI or only host static content, and that exploitation via the web server could certainly have been possible.