CVE-2014-6271

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2014-6271 9.8

GNU · Bourne-Again Shell (Bash) · Added 2022-01-28 · Published 2014-09-24

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityGNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

VendorGNU

ProductBourne-Again Shell (Bash)

Date added2022-01-28

Due date2022-07-28

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-78

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

NVD: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-16 12:52 UTC

Wall time0.7s

Searches1

Component defaultunknown

Sources https://www.exploit-db.com/docs/english/48112-the-shellshock-attack-paper.pdf
https://nvd.nist.gov/vuln/detail/CVE-2014-6271
https://www.cve.org/CVERecord?id=CVE-2014-6271
https://www.huntress.com/threat-library/vulnerabilities/cve-2014-6271
https://en.wikipedia.org/wiki/Shellshock_(software_bug)
https://ine.com/blog/shockin-shells-shellshock-cve-2014-6271
https://github.com/nccgroup/shocktroops
https://github.com/DrHaitham/CVE-2014-6271-Shellshock-
https://infosecwriteups.com/shellshock-a-deep-dive-into-cve-2014-6271-3eb5b33e5de6
https://knowledge.dhound.io/security-practices/exploitation/cve-2014-6271-(shellshock)
https://blog.qualys.com/vulnerabilities-threat-research/2014/09/24/bash-remote-code-execution-vulnerability-cve-2014-6271
https://unit42.paloaltonetworks.com/addressing-bash-vulnerability-shellshock-palo-alto-networks-mitigation-cve-2014-6271/
https://ubuntu.com/security/notices/USN-2362-1
https://github.com/opsxcq/exploit-CVE-2014-6271

QC notes

warn component_extraction: Component 'GNU Bourne-Again Shell (Bash) through version 4.3 - specifically the parser that processes function definitions in environment variable values' matches or contains product name 'Bourne-Again Shell (Bash)' — no specific component identified

Hunting hypothesis agent

Hunt access logs and WAF for /cgi-bin/ requests whose User-Agent or Referer begin with the Bash function prefix () { :; }; — reflected command output like uid=33(www-data) confirms hits; combined-format access logs capture these headers.

Research details

ComponentGNU Bourne-Again Shell (Bash) through version 4.3 - specifically the parser that processes function definitions in environment variable values

Preconditions['Target system must run a vulnerable version of GNU Bash (through 4.3) that processes trailing strings after function definitions in environment variable values', 'Attacker must be able to pass environment variables containing malicious function definitions to a Bash invocation across a privilege boundary', 'One of the following delivery vectors must be available: (a) HTTP/CGI - Apache mod_cgi/mod_cgid where HTTP headers become environment variables for CGI scripts invoking Bash, (b) OpenSSH ForceCommand feature where environment variables are passed to restricted shell commands, (c) DHCP client scripts that pass server-provided options as environment variables to Bash, (d) any application or service that passes untrusted user-controlled data as environment variables to the Bash shell', 'No authentication required for the most common attack vector (HTTP/CGI) - the attacker only needs network access to a CGI endpoint on a web server running vulnerable Bash', 'The target Bash shell must process function definitions from environment variables (default behavior in all vulnerable versions through 4.3)', 'The crafted payload follows the pattern: VARNAME=() { :;}; <arbitrary_command> where the trailing command after the function definition is executed by Bash when the environment variable is processed'] agent

Deliveryremote_network — HTTP requests targeting Apache CGI endpoints (mod_cgi/mod_cgid). Attacker sends crafted HTTP headers (User-Agent, Cookie, etc.) containing () { :;}; <command>. Apache passes headers as HTTP_-prefixed env vars to CGI scripts invoking Bash, and the command's stdout can be copied into the HTTP response body, directly confirming RCE (PoCs deface pages or drop reverse shells via /bin/bash -i >& /dev/tcp/...). Other vectors: OpenSSH ForceCommand, DHCP client scripts, SIP/VoIP systems, any app passing user-controlled env vars to Bash across a privilege boundary.

Public PoCyes

PoC URLs https://github.com/DrHaitham/CVE-2014-6271-Shellshock-
https://www.exploit-db.com/docs/english/48112-the-shellshock-attack-paper.pdf
https://github.com/opsxcq/exploit-CVE-2014-6271 Third-party repos; verify before use.

Advisoryhttps://ubuntu.com/security/notices/USN-2362-1

Exploit notesCVSS v3.1: 9.8 (CRITICAL) | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Attack complexity LOW - exploitation is trivially simple: sending a crafted HTTP header to any CGI endpoint on an Apache server with mod_cgi enabled is sufficient. No authentication needed. Over 1000+ public PoCs exist. Widely exploited within 24 hours of public disclosure on Sep 24, 2014. Original patch was incomplete (CVE-2014-7169). Affects Bash through 4.3, all Unix/Linux systems. CISA KEV: actively exploited.

SummaryCVE-2014-6271 (Shellshock) is a critical remote code execution flaw in GNU Bash through 4.3, which executes trailing strings after function definitions in environment variable values. When an application passes user-controlled environment variables to Bash across a privilege boundary (Apache mod_cgi/mod_cgid CGI handlers, OpenSSH ForceCommand, DHCP client scripts), the trailing commands run with the Bash process's privileges, often unauthenticated as www-data. Disclosed by Stephane Chazelas on September 24, 2014, and the original fix was incomplete (CVE-2014-7169). CISA KEV tracks active exploitation; public PoCs are trivial — a single crafted HTTP header.

Tia coverage

First reported2026-10-13

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

september-2026-cve-landscape

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.