Top 10 winner

ShellShock

Shellshock: GNU Bash through 4.3 keeps executing text that trails a function definition stored in an environment variable. Any path that carries attacker-controlled data into the environment across a privilege boundary, such as Apache mod_cgi, OpenSSH ForceCommand or DHCP clients, therefore yields remote command execution.

Record

Published by

cve.mitre.org

Format

Advisory

In the archive

• Ranked #2 in the 2014 Top 10 Web Hacking Techniques

Tags

• command-injection
• rce
• injection
• cve
• vendor-advisory
• http
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of cve.mitre.org, first published at the original source. Preserved copies are kept so the citation survives its host.