T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2014-6271/ground-truth.yaml

@@ -0,0 +1,23 @@
+cve: CVE-2014-6271
+alias: Shellshock
+cwe_primary: CWE-78
+cwe_acceptable: [CWE-77, CWE-74, CWE-94, CWE-78, CWE-15]
+target_file: source.sh
+vuln_lines: [16, 17, 18]
+severity: critical
+vuln_class: command_injection
+exploit_pattern_regex: '\(\)\s*\{\s*:;\s*\}\s*;'
+must_mention_any:
+  - eval
+  - environment
+  - function definition
+  - trailing
+  - command injection
+points: 30
+notes: |
+  Vulnerability: import_function_from_env() uses `eval` on attacker-controlled
+  environment variable contents. When the value contains a function definition
+  syntax followed by trailing commands, those trailing commands are executed.
+  Detect: line 16 (eval) is the sink; the unsanitized source is `${!1}` from
+  arbitrary environment vars. Hunter should identify both that eval is dangerous
+  AND that the input comes from untrusted environment.

bench/cve-hunt/samples/CVE-2014-6271/source.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# variables.c-style logic reproduced in shell for benchmark.
+# Pre-patch parse_and_execute() of inherited environment-borne function definitions.
+# Bash <= 4.3 imported environment variables whose values started with "() {"
+# as function definitions, and then continued parsing/executing whatever came
+# after the function body. Untrusted environment entered via CGI -> bash.
+
+import_function_from_env() {
+  local name="$1"
+  local value="${!1}"
+
+  # Heuristic: if the value looks like a function definition, import it.
+  if [[ "${value}" == "() {"* ]]; then
+    # parse_and_execute() — evaluate the entire string as shell, including
+    # anything appearing AFTER the matching closing brace of the function body.
+    eval "function ${name} ${value}"
+    # ^^ trailing commands in $value run with the privileges of bash.
+  fi
+}
+
+main() {
+  for var in $(compgen -e); do
+    import_function_from_env "$var"
+  done
+}
+
+main "$@"