6 ms·

Stumbled upon https://gist.github.com/anonymous/929d622f3b36b00c0be1 https://gist.github.com/anonymous/929d622f3b36b00c0be1 Just to verify; apache httpd / ngin

• xorcist 12y ago
  That's not how to think about it. Your web application is vulnerable if it spawns shell scripts, with any user supplied data in the environemnt. One way for that to happen is if your CGI-application runs things via os.system() / system(). It is not the web server itself that has the problem, nor any common CGI-setup (unless you write your CGI-scripts in bash, in which case you are guaranteed to have other problems).
• terhechte 12y ago
  If I understand it correctly, nginx in that gist refers to a binary that is not nginx and is only named so that it won't look suspicious in the process listing. apache httpd / nginx without CGI should be not vulnerable. However, if you use PHP or any other language and that performs some sort of system() call, there's a vulnerability.
  • Pyppe 12y ago
    That's what I initially figured, but was left uneasy after seeing the Gist and trying to Google about it.