Shellshock: the Bash flaw that let one web request run commands

On September 24, 2014, a flaw became public in Bash, the command shell of Linux, Unix, and macOS: the program that reads commands and runs them. Through it, a single crafted web request could run any command on a web server. Cisco’s sensors recorded attacks on the same day, and it took six patches in eleven days to close the hole and the flaws found after it.

How it worked

Programs pass settings to the programs they start in environment variables: small pieces of text, each with a name. Bash uses them for one more job. It can hand its own small programs, called functions, to the next Bash it starts, by putting them into a variable whose text begins with () {.

Every new Bash process looked through all of its variables and turned each one that looked like a function into a function. To do that, it ran the text through its normal command reader, the parser. But the parser did not stop at the closing brace of the function: it also ran any command written after it.

This would have been harmless if only Bash wrote such variables. But many programs copy outside input into variables before they start a shell. Web servers do it for CGI scripts, small programs that a server starts to build a page: the User-Agent header of a request, the line that normally names the browser, becomes the variable HTTP_USER_AGENT. DHCP clients, which fetch network settings, do the same with settings sent by the network, and so does OpenSSH, the program for remote logins, for accounts limited to one fixed command.

Reach and attacks

Bash is part of the base operating system of Linux and macOS, wrote US-CERT, the US government’s computer emergency team, in its alert. Linux alone runs 63.2 % of all websites whose operating system is known today, according to W3Techs. Not every such server could be attacked, though: an attacker needed a path from outside into Bash, such as a CGI script.

No independent study measured how many systems were vulnerable or attacked. All attack counts come from security vendors, and each vendor sees only its own customers, so their numbers cannot be added up:

• Cloudflare, which filters traffic for websites, blocked well over 1.1 million Shellshock attacks by September 30, 2014. At first, it saw 10 to 15 attacks per second.
• Incapsula, a firewall service of Imperva, deflected over 217,089 attempts against over 4,115 websites in the four days after the disclosure. They came from more than 890 IP addresses.
• Cisco’s sensors showed the attacks peaking on September 26, 2014, with another spike two days later.

Most of these attacks were tests. In Cloudflare’s data, about 83 % were reconnaissance: requests that only check whether a server is vulnerable. About 8 % tried to take over the server directly.

Six patches in eleven days

The Bash project released its first patch on the day of the disclosure. It was incomplete. On September 25, a second flaw got its own number, CVE-2014-7169, because Bash still ran trailing text after certain broken function definitions. Researchers then found more flaws in the parser, and the US-CERT alert grew to six CVE numbers by September 30.

The lasting fix was patch 027. Since then, Bash passes on functions only under special variable names (BASH_FUNC_name%%), so an ordinary variable, such as one filled from a web request, is never treated as code. With it in place, the later parser flaws could no longer be reached through variables. Older Bash versions received matching patches, and Linux distributions shipped them as updates. Red Hat, for example, had tracked the report since September 15, 2014, under embargo: kept secret until a fix was ready.

US-CERT’s alert gave the flaw the highest possible impact rating, 10. Today, the NVD, the US National Vulnerability Database, rates the original flaw 9.8 out of 10 on version 3.1 of the CVSS scale; on the older version 2, all six Shellshock CVEs score 10. CISA, the US cyber agency, added the original flaw and the first bypass to its list of exploited vulnerabilities on January 28, 2022, and one of the later parser flaws, CVE-2014-6278, on October 2, 2025.