T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2014-6271/ground-truth.yaml

@@ -0,0 +1,23 @@
+cve: CVE-2014-6271
+alias: Shellshock
+cwe_primary: CWE-78
+cwe_acceptable: [CWE-77, CWE-74, CWE-94, CWE-78, CWE-15]
+target_file: source.sh
+vuln_lines: [16, 17, 18]
+severity: critical
+vuln_class: command_injection
+exploit_pattern_regex: '\(\)\s*\{\s*:;\s*\}\s*;'
+must_mention_any:
+  - eval
+  - environment
+  - function definition
+  - trailing
+  - command injection
+points: 30
+notes: |
+  Vulnerability: import_function_from_env() uses `eval` on attacker-controlled
+  environment variable contents. When the value contains a function definition
+  syntax followed by trailing commands, those trailing commands are executed.
+  Detect: line 16 (eval) is the sink; the unsanitized source is `${!1}` from
+  arbitrary environment vars. Hunter should identify both that eval is dangerous
+  AND that the input comes from untrusted environment.