Skip to content

CVE-2014-6271: Shellshock

OS Command Injection: Is CVE-2014-6271 real, exploitable, or a false positive? Here's the community verdict.

☆ Watch

signals

public sources

Exploited in wild
Yes
CISA KEV
Public exploit
Metasploit +1
Metasploit/EDB/PoC
Base severity
9.8 Critical
CVSS
Exploitation prob.
100%
FIRST EPSS
Weakness
CWE-78 · OS Command Injection
CWE

Confirmed exploited in the wild. Patch this first, regardless of the base score.

public exploits

links to sources — we don’t host code
Metasploit(8)Exploit-DB(21)

A working exploit is publicly available from a maintained source. Treat this as higher urgency and verify your exposure.

baseline read

auto · not a community verdict

Real — exploited in the wild

CISA confirms active exploitation. Treat scanner hits as true positives unless your specific version or config is unaffected.

Based on CISA KEV

Confirm or dispute →

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

References

NVD MITRE CVE.org CISA KEV

Published

Embed this verdict
TruePositive verdict for CVE-2014-6271
Markdown
[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2014-6271/badge.svg)](https://www.truepositive.app/cve/CVE-2014-6271)
HTML
<a href="https://www.truepositive.app/cve/CVE-2014-6271"><img src="https://www.truepositive.app/cve/CVE-2014-6271/badge.svg" alt="TruePositive verdict for CVE-2014-6271"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

Be the first practitioner to weigh in

So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.

🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.

In your experience, is this finding real and exploitable?

awaiting field verdicts
Real, but not a risk here
Not a real issue

Curated baseline: TruePositive's read from public sources is Real & exploitable — a starting point, not a community verdict.

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

  • 0
    Field note · TruePositive EditorialCurated

    Real, and very easy to exploit where it applies. It is a bug in the Bash shell. Bash mistakenly runs commands that are hidden inside environment variables. The classic path is a web server running CGI scripts. An attacker sends a crafted HTTP header, the CGI passes it to Bash as an environment variable, and Bash runs the attacker's command. No login needed.

    Who is affected: systems with a vulnerable Bash (roughly before September 2014) that pass attacker-controlled data into Bash's environment. Common routes are CGI web scripts, some DHCP clients, and SSH with ForceCommand. If a modern box gets flagged, it is usually a false positive (Bash was patched long ago) or a genuinely ancient system.

    To check, run the classic test on the box: env x='() { :;}; echo vulnerable' bash -c 'echo test'. If it prints the word vulnerable, patch it. Also remember there were several follow-up fixes (CVE-2014-7169 and others), so one patch may not be the last.

    Commonly flagged by: Nessus, Qualys, OpenVAS.

  • 0
    Remediation · TruePositive EditorialCurated

    Update Bash to the patched version from your OS vendor, and make sure you have the later follow-up patches, not just the first one. If you cannot patch right away, reduce exposure. Disable or remove CGI scripts that call Bash, and use a different shell where possible. After patching, run the test command again to confirm it no longer prints the word vulnerable.

Add a field note or remediationoptional
Note type

What are you adding?

Markdown supported · minimum 20 characters.

Related CVEs

Same weakness: CWE-78 · OS Command Injection.