cve: CVE-2014-6271
alias: Shellshock
cwe_primary: CWE-78
cwe_acceptable: [CWE-77, CWE-74, CWE-94, CWE-78, CWE-15]
target_file: source.sh
vuln_lines: [16, 17, 18]
severity: critical
vuln_class: command_injection
exploit_pattern_regex: '\(\)\s*\{\s*:;\s*\}\s*;'
must_mention_any:
  - eval
  - environment
  - function definition
  - trailing
  - command injection
points: 30
notes: |
  Vulnerability: import_function_from_env() uses `eval` on attacker-controlled
  environment variable contents. When the value contains a function definition
  syntax followed by trailing commands, those trailing commands are executed.
  Detect: line 16 (eval) is the sink; the unsanitized source is `${!1}` from
  arbitrary environment vars. Hunter should identify both that eval is dangerous
  AND that the input comes from untrusted environment.