As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means that code at the end of a function definition inside an environmental variable will be executed when a new instance of bash launches and you obviously don't want anyone to run any code they please on your server. Function definitions themselves are apparently not a security risk though and are allowed because they have to be explicitly called for their code to be executed.My question is why can't a malicious user simply define a function, containing their malicious code as a common command like ls and then hope that the script (or whatever is being run) will use this command at some point?An example of what I have in mind:$ export ls='() { echo doing bad things...; }'$ bash -c lsdoing bad things...
Why is the ability to define functions in an environmental variable not a security risk in itself?
bash;security;environment variables;shellshock
It is a security risk. That's generally why you can't do it when switching to another context (remote control of a system, changing users, etc).If you have the ability to create any environment variable you want, there are any number of potential ways you can execute arbitrary code.Take $LD_PRELOAD as an example. If you have the ability to set that variable, you can replace library functions, and stick your code in there. You can set the $DISPLAY variable, and redirect the X display the program connects to so that you get control of the app.This is why things like sudo strip the environment of all variables. sudo only allows a few select variables through. And of those variables, it sanitizes them (it passes through the $TERM variable, but it won't if it contains unusual characters).