Digital Defenders
Home / Famous vulnerabilities

Famous vulnerabilities · 06

Shellshock (CVE-2014-6271)

A decades-old Bash quirk that turned web requests into shell commands.

  • CVE CVE-2014-6271 (+5 related)
  • CVSS 10.0
  • Disclosed 24 Sep 2014
  • Affected Bash 1.14 – 4.3
  • KEV Yes
HTTP requestGET /cgi-bin/statusUser-Agent:() { :; }; /bin/idApache mod_cgicopies requestheaders intoenv variablesEnvironmentHTTP_USER_AGENT=() { :; }; /bin/idBash startsimports the"function",runs the tail() { :; }; /bin/idlooks like a functiondefinition (harmless)trailing command:Bash runs it!Fix: patched Bash. The first patch was incomplete (CVE-2014-7169 and others followed).
HTTP requestGET /cgi-bin/statusUser-Agent: () { :; }; /bin/idApache mod_cgicopies request headers into environmentvariablesEnvironmentHTTP_USER_AGENT=() { :; }; /bin/idBash startsimports the "function" and runs the tail() { :; };looks like afunction: harmless/bin/idtrailing command:Bash runs it!Fix: patched Bash (the first patch wasincomplete)
Diagram: Shellshock

Shellshock (also called Bashdoor) was a flaw in GNU Bash, the default shell on most Linux systems. Bash lets a parent process pass function definitions to a child through environment variables. The bug: when Bash imported a value that started like a function, () { :; };, it also ran any command written after it. Stéphane Chazelas found it and it was disclosed on 24 September 2014.

The danger was in how other software fed Bash. Web servers using CGI (such as Apache with mod_cgi) copy HTTP headers like User-Agent into environment variables before running a script. If that script was Bash, or called Bash, a single request with a crafted header executed commands on the server, with no login required. Attackers were building botnets with it within hours of disclosure.

The first patch turned out to be incomplete, which is why CVE-2014-7169 and several related CVEs followed within days; the real fix meant updating Bash more than once. The lessons: treat anything that crosses a trust boundary (headers, DHCP options, SSH forced commands) as hostile input, and expect follow-up patches for high-profile bugs.

Real-world examples

A bot taking over web servers (Sept 2014)Days after disclosure, a researcher found and published a remotely controlled bot that was trying to take over vulnerable web servers.thehackernews.com ↗ SANS ISC: a collection of Shellshock exploits seen in the wildReal attack requests captured by honeypots and sensors, from scanners to malware droppers.isc.sans.edu ↗
Sources

Updated on 12 Nov 2026