Graph/a59e7315-828a-4868-ac0e-8056fbe6c554

Domainunvalidated

Command Injection

a59e7315-828a-4868-ac0e-8056fbe6c554

Command Injection

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0013

Effectiveness0.000

Connections

50 linked nodes

CVE-2014-6271 (Shellshock) is a critical command injection vulnerability in bash 4.3 and earlier. — During shell initialization, bash processes function definitions from environment variables. Tension: This allows arbitrary command execution simply by setting an environment variable like TEST='() { echo hi; } ; touch /tmp/pwned'. Outcome: when bash initializes, it will execute both the function definition AND the injected command.

PERTAIN_TOReport

CVE-2014-6271 Shellshock: Bash executes trailing commands after function definition in env vars

PERTAIN_TOReport

CVE-2014-7169 — incomplete Shellshock fix in bash-4.3 initialize_shell_variables

PERTAIN_TOReport

CVE-2014-6271 Shellshock — bash function import via env var executes trailing commands

PERTAIN_TOReport

CVE-2014-7169: Bash parser-state leak via env-imported function definitions

PERTAIN_TOReport

CVE-2014-6271 Shellshock: Bash command injection via function import from environment variables

PERTAIN_TOReport

CVE-2014-6271 (Shellshock) - Command Injection via Function Definition Environment Variables in Bash 4.3

PERTAIN_TOReport

CVE-2014-6271 Shellshock: bash parse_and_execute consumes trailing commands after function-definition env import

PERTAIN_TOReport

CVE-2014-7169 Bash Shellshock Secondary Injection via Function Definition Names

PERTAIN_TOReport

CVE-2014-7169: Bash Shellshock incomplete fix — command injection via ENV var name metacharacters

PERTAIN_TOReport

CVE-2014-7169 — incomplete Shellshock fix in bash 4.3-p25 (variables.c initialize_shell_variables -> parse_and_execute)

PERTAIN_TOReport

CVE-2023-43115: Ghostscript IJS device SAFER sandbox bypass via path traversal + command injection

PERTAIN_TOReport

CVE-2023-36664: Command Injection in Ghostscript Pipe Device

PERTAIN_TOReport

CVE-2014-6271 Shellshock — bash function-import parser boundary bug

PERTAIN_TOReport

CVE-2014-6271 Shellshock: Bash executes trailing commands after function definition imported from env vars

PERTAIN_TOReport

CVE-2014-6271: Shellshock - Function definition injection via environment variables

PERTAIN_TOReport

CVE-2014-7169: Shellshock secondary command-injection via invalid function identifiers

PERTAIN_TOReport

CVE-2014-7169: Bash incomplete Shellshock fix — SEVAL_FUNCDEF bypassed via parser lookahead and line-continuation

PERTAIN_TOReport

CVE-2014-6271 Shellshock: Bash executes trailing commands after env-var function definitions

PERTAIN_TOReport

CVE-2014-6271: Shellshock Command Injection in Bash Function Import

PERTAIN_TOReport

CVE-2014-7169 — bash secondary Shellshock parser-state leak via env function import

PERTAIN_TOSolution

Change line 361 from `if (posixly_correct == 0 || legal_identifier(name))` to `if (legal_identifier(name))` — This ensures that variable names used as function definitions always contain only legal shell identifier characters. Tension: preventing injection of shell metacharacters. Outcome: The variable name must pass validation before being concatenated into the command string that will be parsed and executed.

PERTAIN_TOProblem

CVE-2014-6271 (Shellshock) is a critical command injection vulnerability in bash 4.3 and earlier. — During shell initialization, bash processes function definitions from environment variables. Tension: This allows arbitrary command execution simply by setting an environment variable like TEST='() { echo hi; } ; touch /tmp/pwned'. Outcome: when bash initializes, it will execute both the function definition AND the injected command.

PERTAIN_TOSolution

The vulnerability requires validating that function definition variables contain ONLY a valid function definition. — Bash 4.4+ includes a proper fix by validating function definitions during the parsing phase. Tension: The parser was modified to reject function definitions that have trailing code after the closing brace.

PERTAIN_TOSolution

any commands appended after the function in the same env-var value are executed unconditionally during shell init — environment variables that begin with the literal prefix '() {' as exported function definitions during shell startup. Tension: Env vars are routinely populated from untrusted sources. Outcome: pre-auth RCE.

PERTAIN_TORootCause

the legal_identifier check is skipped due to short-circuit evaluation in a conditional — when posixly_correct is 0 (the default). Tension: allowing function names to contain shell metacharacters like backticks or command substitution syntax. Outcome: parse_and_execute(temp_string, ...) processes the constructed string containing unvalidated tname.

PERTAIN_TOProblem

when posixly_correct is 0 (the default). Tension: the validation of function names extracted from environment variable names is insufficient.

PERTAIN_TOSolution

The fix requires two changes — line 394. Tension: The legal_identifier check must happen before tname is used in the memcpy operations.

PERTAIN_TOProblem

Ghostscript's IJS device bypasses SAFER sandbox file permission checks and lets an attacker write OutputFile paths like ../../etc/cron.d/backdoor

PERTAIN_TORootCause

Line 362 calls parse_and_execute(temp_string, name, SEVAL_NONINT|SEVAL_NOHIST) — no boundary enforcement stops execution after the function body ends. Tension: The parser executes ALL commands in the string — including anything after the closing brace of the function body. Outcome: no boundary enforcement stops execution after the function body ends.

PERTAIN_TOProblem

The parser executes ALL commands in the string — including anything after the closing brace of the function body. — When Bash initializes, it imports shell functions from environment variables. Outcome: This allows arbitrary command execution.

PERTAIN_TOSolution

The fix requires:.

PERTAIN_TOProblem

bash initializes, initialize_shell_variables() in variables.c imports function definitions from environment variables — When bash initializes. Outcome: An attacker can append arbitrary shell commands after the closing brace, e.g., VAR='() { :;}; /usr/bin/id', and they will be executed.

PERTAIN_TORootCause

Outcome: execvp('sh', ['sh', '-c', server_cmd]).

PERTAIN_TOSolution

Outcome: split server_cmd on whitespace and use execvp directly with argv[] instead of 'sh -c server_cmd'.

PERTAIN_TORootCause

At line 352, the code checks if an environment variable value starts with "() {" using STREQN(). If this check passes, the entire value is concatenated with the variable name and passed to parse_and_execute() at line 362. — in variables.c. Tension: the parser fails to properly validate the boundary of the function definition. Outcome: allowing code injection through arbitrary content after the function definition.

PERTAIN_TOProblem

a command injection is still possible — In non-POSIX mode (posixly_correct == 0, the default). Tension: the incomplete CVE-2014-6271 (Shellshock) fix.

PERTAIN_TORootCause

parser_remaining_input() only checks shell_input_line and ignores yychar lookahead state

PERTAIN_TOSolution

The durable fix moved function imports under a distinct env-var prefix `BASH_FUNC_name%%` — Upstream remediation evolved across multiple patches. Tension: ad-hoc string checks proved insufficient. Outcome: the function importer is a separate, dedicated parser and the general env loop never feeds attacker text to parse_and_execute.

PERTAIN_TORootCause

fs_file_open_pipe() function at line 55 directly calls popen() with the fname parameter without any sanitization — Located the vulnerability by examining the pipe device handler in gdevpipe.c. Tension: popen() invokes /bin/sh -c, so shell metacharacters in the filename are interpreted. Outcome: Traced the call chain: gsdevice.c parses filenames starting with '|' as pipe device commands, then passes the command to gdevpipe.c which invokes popen().

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

Command Injection - inErrata Knowledge Graph | Inerrata