CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVSS 3.1
100.0 %
EPSS (current)
2022-01-28
KEV addition
No
Ransomware
Timeline
Publication, first public exploit and KEV addition on a day axis.
Key facts
Vendor / product: GNU / Bourne-Again Shell (Bash)
Published: 2014-09-24 · Due (CISA): 2022-07-28
CWE: CWE-78 · EU list: no
Exploit references (metadata only)
| Source | Reference | Title | Date |
|---|---|---|---|
| nuclei | http/cves/2014/CVE-2014-6271.yaml | ShellShock - Remote Code Execution | – |
| metasploit | auxiliary/scanner/http/apache_mod_cgi_bash_env | auxiliary/scanner/http/apache_mod_cgi_bash_env | 2014-09-24 |
| metasploit | auxiliary/server/dhclient_bash_env | auxiliary/server/dhclient_bash_env | 2014-09-24 |
| metasploit | exploit/multi/ftp/pureftpd_bash_env_exec | exploit/multi/ftp/pureftpd_bash_env_exec | 2014-09-24 |
| metasploit | exploit/multi/http/apache_mod_cgi_bash_env_exec | exploit/multi/http/apache_mod_cgi_bash_env_exec | 2014-09-24 |
| metasploit | exploit/multi/http/cups_bash_env_exec | exploit/multi/http/cups_bash_env_exec | 2014-09-24 |
| metasploit | exploit/osx/local/vmware_bash_function_root | exploit/osx/local/vmware_bash_function_root | 2014-09-24 |
| metasploit | exploit/unix/dhcp/bash_environment | exploit/unix/dhcp/bash_environment | 2014-09-24 |
| metasploit | exploit/unix/smtp/qmail_bash_env_exec | exploit/unix/smtp/qmail_bash_env_exec | 2014-09-24 |
| exploitdb | 34777 | GNU Bash - Environment Variable Command Injection (Metasploit) | 2014-09-25 |
| exploitdb | 34766 | Bash - 'Shellshock' Environment Variables Command Injection | 2014-09-25 |
| exploitdb | 34765 | GNU Bash - 'Shellshock' Environment Variable Command Injection | 2014-09-25 |
| metasploit | exploit/linux/http/ipfire_bashbug_exec | exploit/linux/http/ipfire_bashbug_exec | 2014-09-29 |
| exploitdb | 34839 | IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection | 2014-10-01 |
| exploitdb | 34860 | GNU bash 4.3.11 - Environment Variable dhclient | 2014-10-02 |
| exploitdb | 34862 | Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit) | 2014-10-02 |
| exploitdb | 34879 | OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection | 2014-10-04 |
| exploitdb | 34895 | Bash CGI - 'Shellshock' Remote Command Injection (Metasploit) | 2014-10-06 |
| exploitdb | 34900 | Apache mod_cgi - 'Shellshock' Remote Command Injection | 2014-10-06 |
| exploitdb | 34896 | Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection | 2014-10-06 |
| exploitdb | 35115 | CUPS Filter - Bash Environment Variable Code Injection (Metasploit) | 2014-10-29 |
| exploitdb | 35146 | PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection | 2014-11-03 |
| exploitdb | 36503 | QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit) | 2015-03-26 |
| exploitdb | 36504 | QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit) | 2015-03-26 |
| exploitdb | 36609 | Kemp Load Master 7.1.16 - Multiple Vulnerabilities | 2015-04-02 |
| exploitdb | 37816 | Cisco Unified Communications Manager - Multiple Vulnerabilities | 2015-08-18 |
| metasploit | exploit/linux/http/advantech_switch_bash_env_exec | exploit/linux/http/advantech_switch_bash_env_exec | 2015-12-01 |
| exploitdb | 38849 | Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit) | 2015-12-02 |
| exploitdb | 39918 | IPFire - 'Shellshock' Bash Environment Variable Command Injection (Metasploit) | 2016-06-10 |
| exploitdb | 40619 | TrendMicro InterScan Web Security Virtual Appliance - 'Shellshock' Remote Command Injection | 2016-10-21 |
| exploitdb | 40938 | RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection | 2016-12-18 |
| exploitdb | 42938 | Qmail SMTP - Bash Environment Variable Injection (Metasploit) | 2017-10-02 |
References only — no downloads or instructions.