mitre / mitre/secure-coding-case-studies
Shellshock/Bashdoor
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11
- Forks
- 45
- PR merge metrics
- No merged PRs in 30d
Description
I propose to write a case study following the Shellshock vulnerability. In Essence, the Shellshock vulnerability allowed attackers to write arbitrary functions in bash to allow unauthorized commands. It has been corrected and reestablished as an issue several times. Some of the proposed fixes did anything but and allowed the issues to preside. The original CVE classification for this vulnerability was CVE-2014-6271, but this has changed several times as new patches came and exposed further vulnerabilities. I will list all the CVE titles it has gone through: CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187.
https://nvd.nist.gov/vuln/detail/CVE-2014-6271
https://nvd.nist.gov/vuln/detail/CVE-2014-7187
https://www.theregister.com/2014/09/24/bash_shell_vuln/
https://www.wired.com/2014/09/hackers-already-using-shellshock-bug-create-botnets-ddos-attacks/
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the linked NVD entries and the Register and Wired articles; the payload names no repository file or entry point. A completed case study should explain Shellshock, its attempted fixes, and the listed CVE progression using the referenced sources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100