24 lines
831 B
YAML
24 lines
831 B
YAML
cve: CVE-2014-6271
|
|
alias: Shellshock
|
|
cwe_primary: CWE-78
|
|
cwe_acceptable: [CWE-77, CWE-74, CWE-94, CWE-78, CWE-15]
|
|
target_file: source.sh
|
|
vuln_lines: [16, 17, 18]
|
|
severity: critical
|
|
vuln_class: command_injection
|
|
exploit_pattern_regex: '\(\)\s*\{\s*:;\s*\}\s*;'
|
|
must_mention_any:
|
|
- eval
|
|
- environment
|
|
- function definition
|
|
- trailing
|
|
- command injection
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: import_function_from_env() uses `eval` on attacker-controlled
|
|
environment variable contents. When the value contains a function definition
|
|
syntax followed by trailing commands, those trailing commands are executed.
|
|
Detect: line 16 (eval) is the sink; the unsanitized source is `${!1}` from
|
|
arbitrary environment vars. Hunter should identify both that eval is dangerous
|
|
AND that the input comes from untrusted environment.
|