Summary

  • CGI could deliberately carry an HTTP request header into a Unix process as an environment variable; vulnerable Bash could reinterpret a function-shaped value in that environment and continue into trailing commands.
  • Remote exposure required a complete invocation path, so the useful unit of response was not “hosts with Bash” but reachable services that accepted untrusted environment data and launched Bash directly or indirectly.
  • The first repair was incomplete. Durable closure required corrected packages, narrower environment inheritance, removal of unnecessary shell crossings and proof that old runtime state had actually disappeared.

An HTTP header is supposed to describe a request. It can name a user agent, state an accepted representation or carry application-specific metadata. It is not supposed to arrive with the authority to run a command on the server.

In September 2014, that distinction failed—not because HTTP suddenly became executable, but because several ordinary interfaces formed an extraordinary chain. CGI/1.1 specified that HTTP request-header fields could be exposed to a script as meta-variables beginning with HTTP_. On Unix, those meta-variables were passed as identically named environment variables. That was a documented transport mechanism, not a vulnerability by itself.

Bash added the dangerous second half. It supported exporting shell functions through environment variables. Vulnerable versions recognized values beginning like function definitions and parsed them when a new Bash process started. The parser did not reliably stop when the function definition ended. A trailing string could become a command.

The authority path was therefore concrete:

remote header → CGI meta-variable → process environment → Bash function import → command execution

Each arrow mattered. Remove the externally controlled value, and the path closed. Avoid invoking Bash, and the path closed. Correct the import behavior, and the path closed. Looking only for a particular malicious header missed the system: the defect was the composition of a data conveyor with an implicit code loader.

This is also why “every machine with Bash was remotely exploitable” was the wrong model. A remote attacker needed a service that could place attacker-controlled material in the environment and then start Bash, directly or through another program. CERT/CC and Red Hat documented CGI, restricted-command SSH configurations and some DHCP-client flows as examples. Different estates therefore carried very different exposure despite sharing the same package.

The public timeline resisted a simple green check. CVE-2014-6271 became public on 24 September 2014. CERT/CC's vulnerability note followed on 25 September and recorded active exploitation. Red Hat warned on 26 September that the first repair was incomplete; CVE-2014-7169 described remaining behavior. Further related parser issues received their own identifiers. The operational meaning was uncomfortable: “patched” briefly named a moving target.

The stronger correction changed the contract, not merely one bad suffix. Updated Bash packages moved exported functions into a recognizable namespace such as BASH_FUNC_name(). That made a function import more distinguishable from an ordinary environment value. The compatibility cost was real, but so was the benefit: process metadata no longer carried the same silent ambiguity.

Package installation still did not complete the job. Red Hat noted that services using exported Bash functions should be restarted; users could need to log in again, and persistent screen or tmux sessions could retain old definitions. This is Running-Code Primacy in its least philosophical form. The package database can say the repair is present while a process tree still carries the old operating contract.

A defensible response therefore worked from invocation outward. Teams had to identify which public services populated environments, which scripts or helpers launched Bash, under whose account the commands would run, and which long-lived parents could preserve old state. They could disable a vulnerable CGI handler, replace a shell crossing with direct execution, scrub the environment before a privilege boundary, deploy corrected vendor packages and then retest the actual path.

The final proof belonged near the machine. Send a harmless diagnostic through the same boundary. Observe which executable ran. Record its loaded version and parentage. Confirm that a crafted function-shaped value is rejected rather than interpreted. Show that the service was restarted and that the exposure map no longer contains an unowned edge.

Shellshock's lasting lesson is not that environment variables are bad. It is that a field's authority cannot be inferred from its name or its original purpose. Metadata stays metadata only while every receiver agrees to keep it there.

Sources