Saint Shellshock, Who Ran What Was Only a Greeting

Patron of CGI servers, environment variables, and everything that has a forgotten Bash inside.

Life

On 24 September 2014 Stéphane Chazelas revealed Shellshock, a flaw in the Bash shell that had been present for over twenty years. Bash executed the code hidden after a function definition passed in an environment variable: so a web request, a DHCP client or a CGI server could make an attacker's commands run, with no authentication at all. It was everywhere, and for days patch after patch chased down every variant.

Prayer

O Saint Shellshock, who turn a greeting into a command, let our environment variables stay text and never become code. Amen.

How to celebrate

Celebrated by updating Bash to a fixed version and hunting down every forgotten CGI that invokes it.

An environment variable, a surprising command.