A remotely exploitable hole in bash

Posted Sep 25, 2014 17:43 UTC (Thu) by gb (subscriber, #58328)
In reply to: A remotely exploitable hole in bash by gb
Parent article: A remotely exploitable hole in bash

Cool - hidden environment variables. Nice implementation detail.

$ cat /proc/$$/environ |xargs -0 -n1|grep -w A
A=() { echo "My func"

$ env|grep -w A
A=3
A=() { echo "My func"

Means that if someone sets such function in HTTP or something.. you would never see it if you just do $ABCD, only if you do env|grep ABCD

A remotely exploitable hole in bash

Posted Sep 25, 2014 17:52 UTC (Thu) by gb (subscriber, #58328) [Link] (2 responses)

I reached full stop here. Never knew that it's possible to have two environment variables with same name.

A remotely exploitable hole in bash

Posted Sep 25, 2014 18:15 UTC (Thu) by madscientist (subscriber, #16861) [Link] (1 responses)

The "environment" is just an array of nul-terminated strings. Each string is expected to have the form "NAME=VALUE"; so the name of an environment variable is the characters up to and not including the first equals sign. There's no reason that more than one of these strings can't have the same "NAME" part.

The typical functional API to the environment provided by C and other languages treats the environment as a set of key/value pairs, so using those functions it's usually not possible to have two variables with the same name. But, if you start a program with execve() for example you give your own list of strings as the environment for the child process, and the members of that list can be whatever you want.

A remotely exploitable hole in bash

Posted Sep 25, 2014 20:31 UTC (Thu) by gb (subscriber, #58328) [Link]

Thank you for the explanation... Just never thought about it.

A remotely exploitable hole in bash

Posted Sep 26, 2014 11:05 UTC (Fri) by marcH (subscriber, #57642) [Link] (1 responses)

> Cool - hidden environment variables. Nice implementation detail.

Just found this in the standard:

http://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html

"If more than one string in a process' environment has the same name the consequences are undefined."

A remotely exploitable hole in bash

Posted Sep 26, 2014 14:15 UTC (Fri) by gb (subscriber, #58328) [Link]

So bash, by putting multiple instances of the variable with same name into environment of the programs it run, forces that programs into undefined behavior state. Hm...
$ bash
$ f() { aaa; }
$ export -f f
$ export f=3
$ ksh
$ cat /proc/$$/environ |xargs -0 -n1|grep -w f
f=3
f=() { aaa
$ echo $f
3