Shellshock vulnerability exploitation and mitigation: A demonstration

Abstract

This paper presents a step-by-step demonstration for the exploitation of CVE-2014-6271, affecting the ‘Bourne Again Shell’ (Bash). By design, Bash cannot be accessed via a web server; yet a flaw in its source code provides attackers the ability of Arbitrary Code Execution (ACE) over a Common Gateway Interface (CGI). In this paper, we demonstrate how Shellshock vulnerability can be exploited, as well as outlining mitigation strategies.