CVE-2014-6271: Shellshock
A flaw in how GNU Bash parses function definitions stored in environment variables. Bash keeps executing shell commands appended after a specially formatted function definition, so an attacker who can set an environment variable, commonly through CGI scripts, DHCP clients, or forced SSH commands, can run arbitrary commands on the system.
View the authoritative record on NVD ↗Affected software
- GNU Bash through 4.3
How it's exploited
Set an environment variable to a value like () { :; }; echo vulnerable before Bash is invoked; anything typed after the function definition executes as a shell command, most commonly reached through CGI scripts that copy HTTP headers into environment variables.
Severity
CVE-2014-6271 carries a CVSS 3.1 base score of 9.8, rated Critical. See how CVSS scoring works or score a vulnerability yourself with the free CVSS calculator.
Weakness type
CVE-2014-6271 is categorized under CWE-78, the general weakness pattern behind this specific vulnerability.
How TurboPentest tests for this
TurboPentest's automated black-box pentest actively probes for OS Command Injection using OWASP ZAP and Nuclei, with no source code required. Connecting a GitHub repo adds white-box confirmation from IntegSec's Opengrep SAST rule pack, which carries 12 dedicated rules for this weakness.
Tools: OWASP ZAP, Nuclei
- OS Command Concatenation
- OS Command Injection Tainted Input
- Command Injection Shell Concatenation
- OS Command Injection
- OS Command Concatenation
- OS Command Injection Tainted Input
- Child Process Shell True
- OS Command Injection Tainted Input
- Command Injection Backticks
- OS Command Injection
- OS Command Injection
- Shell True Concatenation
Remediation
Patch Bash to a version that includes the fix (upstream 4.3 patch level 25 or later, or the equivalent vendor backport), and audit anything that passes untrusted input into Bash via environment variables.
Frequently asked questions
What is CVE-2014-6271?
A flaw in how GNU Bash parses function definitions stored in environment variables. Bash keeps executing shell commands appended after a specially formatted function definition, so an attacker who can set an environment variable, commonly through CGI scripts, DHCP clients, or forced SSH commands, can run arbitrary commands on the system.
How severe is CVE-2014-6271?
CVE-2014-6271 has a CVSS 3.1 base score of 9.8 out of 10, rated Critical.
What software is affected by CVE-2014-6271?
CVE-2014-6271 affects GNU Bash through 4.3.
How do you fix CVE-2014-6271?
Patch Bash to a version that includes the fix (upstream 4.3 patch level 25 or later, or the equivalent vendor backport), and audit anything that passes untrusted input into Bash via environment variables.
Where is the authoritative record for CVE-2014-6271?
The National Vulnerability Database (NVD) publishes the authoritative record for CVE-2014-6271 at https://nvd.nist.gov/vuln/detail/CVE-2014-6271, including the current CVSS score, CWE mapping, and affected-configuration data.
Related CVEs
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find known-vulnerable services before an attacker does
TurboPentest fingerprints every open port and web service, then matches detected versions against known CVEs automatically, from $99 per target.
Start a pentest