It doesn't necessarily. But what it does do is pass information about the request in environment variables - that's step 1: attacker controls the contents of an environment variable. Then, if at any point the script invokes bash, or calls something like system(), exec() or popen() and has bash set as the default shell, then bash will run, with those environment variables set. That's step 2, and the server is now the attacker's.

All the modern webserver<->framework interfaces don't call bash directly, but they may end up calling it indirectly in one of a dozen different ways.

And environment variables are typically inherited by subprocesses, so if the CGI script executes anything (that executes anything, recursively) that uses bash (including system() if /bin/sh is bash, e.x. on OS X) this bug becomes exploitable?