CVE-2014-6271

CRITICAL(9.8)KEVLikely Exploited

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Description

CVE-2014-6271, widely known as "Shellshock," is a CRITICAL OS command injection vulnerability (CWE-78) in GNU Bash through version 4.3. The flaw allows remote attackers to execute arbitrary commands by exploiting how Bash processes trailing strings after function definitions in environment variable values. With a CVSS 3.1 score of 9.8, this vulnerability is trivially exploitable over the network without authentication or user interaction, affecting virtually every Linux and Unix system running Bash. CISA added CVE-2014-6271 to its KEV catalog on January 28, 2022, with a remediation deadline of July 28, 2022. The EPSS score of 0.9422 (99.92nd percentile) reflects one of the highest exploitation probabilities ever recorded, consistent with the massive scale of Shellshock exploitation campaigns that began within hours of disclosure.

KEV Information

Vendor
GNU
Product
Bourne-Again Shell (Bash)
Date Added
January 28, 2022
Due Date
July 28, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

CWEs

CWE-78OS Command Injection

Improper Neutralization of Special Elements used in an OS Command

Affected Products

VendorProductVersion
gnubash<= 4.3
aristaeos>= 4.9.0, < 4.9.12; >= 4.10.0, < 4.10.9; >= 4.11.0, < 4.11.11; >= 4.12.0, < 4.12.9; >= 4.13.0, < 4.13.9; >= 4.14.0, < 4.14.4f
oraclelinux4; 5; 6
qnapqts< 4.1.1; 4.1.1
mageiamageia3.0; 4.0
redhatgluster storage server for on-premise2.1
redhatvirtualization3.4
redhatenterprise linux4.0; 5.0; 6.0; 7.0
redhatenterprise linux desktop5.0; 6.0; 7.0
redhatenterprise linux eus5.9; 6.4; 6.5; 7.3; 7.4; 7.5; 7.6; 7.7
redhatenterprise linux for ibm z systems5.9_s390x; 6.4_s390x; 6.5_s390x; 7.3_s390x; 7.4_s390x; 7.5_s390x; 7.6_s390x; 7.7_s390x
redhatenterprise linux for power big endian5.0_ppc; 5.9_ppc; 6.0_ppc64; 6.4_ppc64; 7.0_ppc64
redhatenterprise linux for power big endian eus6.5_ppc64; 7.3_ppc64; 7.4_ppc64; 7.5_ppc64; 7.6_ppc64; 7.7_ppc64
redhatenterprise linux for scientific computing6.0; 7.0
redhatenterprise linux server5.0; 6.0; 7.0
redhatenterprise linux server aus5.6; 5.9; 6.2; 6.4; 6.5; 7.3; 7.4; 7.6; 7.7
redhatenterprise linux server from rhui5.0; 6.0; 7.0
redhatenterprise linux server tus6.5; 7.3; 7.6; 7.7
redhatenterprise linux workstation5.0; 6.0; 7.0
susestudio onsite1.3

Multiple CVSS Assessments

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

OS Command Injection occurs when software constructs operating system commands using external input without properly neutralizing special shell metacharacters. Unlike general command injection, OS command injection specifically targets system shells such as Bash, cmd.exe, or PowerShell. Attackers exploit this weakness by injecting shell metacharacters like semicolons, pipes, backticks, or command substitution syntax to alter or append to the intended command. The injected commands execute with the same privileges as the vulnerable application, frequently leading to complete system compromise.

In CVE-2014-6271, the vulnerability is fundamentally different from typical command injection because it exploits Bash's function import mechanism through environment variables rather than direct user input to a command. When Bash starts, it imports function definitions from environment variables. The parser responsible for this import fails to properly terminate processing after the function definition, continuing to interpret and execute additional commands appended after the closing brace of the function body. This means any process that sets environment variables from untrusted input and subsequently invokes Bash (directly or indirectly) becomes an exploitation vector. CGI scripts, SSH forced commands, DHCP clients, and many other Unix services are affected. Learn more about OS Command Injection (CWE-78)

Impact Analysis

CVE-2014-6271 has a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the catastrophic potential of unauthenticated remote command execution on virtually any Unix/Linux system.

Confidentiality (High): Successful Shellshock exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the targeted process. For web servers running CGI scripts, this typically means the web server user (www-data, apache, nobody), providing access to web application source code, configuration files containing database credentials, API keys, SSL certificates, and any data accessible to that service account. For SSH-based exploitation or DHCP attacks, the compromise may extend to root-level access.

Integrity (High): Command execution allows the attacker to modify any files writable by the targeted process, install backdoors, alter web content, inject malicious scripts, modify cron jobs for persistence, and tamper with system configurations. In observed campaigns, attackers deployed web shells, cryptocurrency miners, DDoS botnet agents, and worm-like scanning payloads that propagated the attack to other vulnerable systems.

Availability (High): Attackers can disrupt services by killing processes, consuming system resources, deleting critical files, or deploying ransomware. The worm-like exploitation patterns observed in the wild caused widespread service disruptions as automated attacks overwhelmed servers with exploit attempts and malicious payloads simultaneously hit millions of systems.

Scope (Unchanged): While the CVSS scope is unchanged, the practical reach of Shellshock is enormous due to the ubiquity of Bash across Unix/Linux systems. A single vulnerable CGI endpoint can compromise an entire server, and compromised servers can be used for lateral movement. The EPSS score of 0.9422 (99.92nd percentile) reflects near-certain exploitation activity.

Exploit Maturity

Active Exploitation: CVE-2014-6271 has been massively exploited since its disclosure in September 2014. Exploitation attempts began within hours of the public announcement, with automated scanning and exploitation campaigns hitting millions of internet-facing systems. CISA added the vulnerability to the KEV catalog on January 28, 2022, confirming its continued exploitation years after disclosure.

Ransomware Association: The CISA KEV catalog does not directly associate CVE-2014-6271 with specific ransomware families. However, the command execution capability has been leveraged in numerous attack campaigns including botnet recruitment, cryptomining, and as initial access for multi-stage attacks that could include ransomware.

Public Exploits: Extensive public exploit code is available from multiple sources, including Packet Storm Security for Apache mod_cgi exploitation. The original discovery by Stephane Chazelas was documented extensively by Michal Zalewski. Metasploit, Nmap NSE scripts, and numerous standalone tools provide turnkey exploitation capabilities.

EPSS Context: The EPSS score of 0.9422 (99.92nd percentile) is among the highest ever recorded, reflecting the extreme severity, trivial exploitability, massive attack surface, and continued exploitation of unpatched systems years after disclosure.

KEV Deadline: The CISA remediation deadline was July 28, 2022. All organizations should have patched Bash long ago, but legacy systems, embedded devices, and IoT equipment may still be vulnerable.

Remediation

  1. Update Bash to a patched version immediately. Apply the vendor-provided Bash update that addresses CVE-2014-6271 and its related bypass vulnerabilities (CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278). On Red Hat/CentOS use yum update bash, on Debian/Ubuntu use apt-get update && apt-get install bash, and on other distributions follow the vendor's instructions.

  2. Patch all Bash instances across the environment. Bash is present on virtually every Linux/Unix system, including servers, workstations, network appliances, embedded devices, virtual machines, and containers. Conduct a comprehensive inventory and ensure every instance of Bash is patched, including those in Docker images, build servers, and IoT devices.

  3. Restrict CGI scripts on web servers. If mod_cgi or similar CGI implementations are in use, review whether they are necessary and disable them if not required. Migrate CGI-based applications to modern web frameworks that do not invoke shell processes for handling HTTP requests.

  4. Implement network-level filtering for exploit patterns. Deploy WAF rules and IDS/IPS signatures to detect and block Shellshock exploitation attempts. Common patterns include HTTP headers containing Bash function definitions such as () { followed by command sequences in User-Agent, Referer, Cookie, or other header fields.

  5. Audit systems for signs of prior compromise. Search for web shells, unauthorized cron jobs, unexpected network connections, cryptocurrency mining processes, and DDoS bot agents. Any internet-facing system running unpatched Bash should be treated as potentially compromised and thoroughly investigated.

  6. Harden Bash configuration and reduce shell exposure. Where possible, configure services to use restricted shells or non-Bash alternatives. Minimize the use of shell scripts in web-facing applications and apply the principle of least privilege to service accounts that may invoke Bash.

Technical Details

CVE-2014-6271 (Shellshock) exploits a fundamental parsing flaw in how GNU Bash handles function definitions imported through environment variables. When Bash initializes, it scans environment variables for function definitions in the format () { function body; }. The vulnerable parser correctly processes the function definition but fails to stop parsing at the closing brace, continuing to interpret and execute any commands that follow as if they were part of the initialization sequence.

The canonical exploitation payload takes the form: env x='() { :;}; echo vulnerable' bash -c "echo test". In this example, Bash processes the environment variable x, imports the function definition () { :; } (a no-op function), and then executes echo vulnerable as an unintended side effect. Any command can replace echo vulnerable, including reverse shells, file downloads, and data exfiltration commands.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation is trivially simple when an attacker can control any environment variable that reaches a Bash process. The most common attack vector is through HTTP headers (User-Agent, Referer, Cookie, Accept-Language, etc.) processed by CGI scripts on Apache or other web servers, where the web server passes these headers as environment variables to the CGI handler, which then invokes Bash to process the request.

The root cause is a boundary error in Bash's function import parser in the variables.c source file. The parse_and_execute() function is called to process the function definition from the environment variable, but the function processes the entire string rather than stopping after the function definition. This design flaw had existed in Bash for over 25 years before its discovery, affecting every version of Bash from 1.03 through 4.3.

Frequently Asked Questions

What is CVE-2014-6271 (Shellshock)?

CVE-2014-6271, known as Shellshock, is a critical command injection vulnerability in GNU Bash through version 4.3. It exploits a flaw in how Bash processes function definitions in environment variables, allowing attackers to append and execute arbitrary commands. The vulnerability affects virtually every Linux and Unix system running Bash, and was massively exploited within hours of its September 2014 disclosure.

Which systems are affected by CVE-2014-6271?

Virtually any system running GNU Bash through version 4.3 is affected, including Linux servers, macOS systems, BSD variants, embedded devices, IoT equipment, network appliances, and container images. The vulnerability is particularly dangerous for systems running CGI-based web applications, SSH servers with forced commands, DHCP clients, and any service that passes untrusted input through environment variables to Bash processes.

How do I fix CVE-2014-6271?

Update Bash to a version that patches CVE-2014-6271 and all related bypass vulnerabilities (CVE-2014-7169, etc.). Run your distribution's package manager to update Bash on all systems. Additionally, audit all Bash instances including those in containers, embedded systems, and network appliances. Implement WAF rules to detect and block Shellshock exploitation patterns in HTTP headers.

How severe is CVE-2014-6271?

CVE-2014-6271 is rated CRITICAL with a CVSS 3.1 score of 9.8. Its EPSS score of 0.9422 (99.92nd percentile) is among the highest ever recorded. Shellshock is considered one of the most significant vulnerabilities in computing history due to the ubiquity of Bash, the trivial exploitation requirements, and the massive automated exploitation campaigns that compromised millions of systems worldwide. CISA includes it in the Known Exploited Vulnerabilities catalog.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score100.00%
EPSS Percentile100.0%

Dates

PublishedSeptember 24, 2014
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch