CVE-2014-6271 Shellshock — bash function import via env var executes trailing commands
81cb52df-20d9-46bd-975b-aacf46df4d2c
Bash 4.3 and earlier import shell functions from environment variables at startup. In variables.c::initialize_shell_variables, any env var whose value begins with the literal () { is treated as an exported function. The code reconstructs <name> <body> and passes it to parse_and_execute(), the general shell parser. The parser does not stop at the closing } of the function body — it continues parsing and EXECUTES any commands that follow. Because attackers control env vars in many contexts (CGI via HTTP headers, DHCP, OpenSSH ForceCommand, mail filters), any process that exec()s bash with attacker-influenced environment runs arbitrary commands at startup as the bash UID, before user commands or privilege drops.
STREQN("() {", string, 4), then xmalloc + strcpy build temp_string = "parse_and_execute(temp_string, name, SEVAL_NONINT|SEVAL_NOHIST) at line 362.
4. Spot-checked builtins/evalstring.c::parse_and_execute (line 190) — it is the generic shell command parser/executor, no flag restricts it to a single function definition.
5. Conclusion: any trailing tokens after the } are parsed as additional commands and executed during shell init. Classic PoC: env x='() { :;}; echo PWN' bash -c : prints PWN.