Inside Shellshock: How hackers are using it to exploit systems

Re:Inside Shellshock: How hackers are using it to exploit sy... by meowface on Tuesday September 30, 2014 @11:58PM (#8392737)

Upon researching this, "() {" will always catch this.

If you look at the bash source code, the relevant parsing function checks if an environment variable begins with the literal 4-character string of "() {". That's why it's pretty easy to detect exploits: you can't do anything to evade a filter checking for this in an HTTP header. An HTTP server should not be doing any decoding of an HTTP header that could result in "() {" being obfuscated. This may not apply for attacks against things that aren't web apps, though.

[ Parent | on HN ]

Re:Inside Shellshock: How hackers are using it to exploit sy... by nitrogen on Wednesday October 01, 2014 @04:29AM (#8393349)

Upon researching this, "() {" will always catch this.

Unless the input is decoded in some way before reaching an environment variable. E.g. HTML entities, hex escapes (percent or backslash), gzip, ... Best just to patch bash and switch to a different /bin/sh.

[ Parent | on HN ]

Re:Inside Shellshock: How hackers are using it to exploit sy... by meowface on Friday October 03, 2014 @09:41AM (#8405476)

I should have said "will always catch this for CGI servers and HTTP headers".

[ Parent | on HN ]