Hacker News Reader

So if you don't run CGI nor run a system command within your code, are you fairly safe?

If you do have some gem that runs a system cmd, wouldn't it still require url input to get passed down to that command?

I'm not advocating NOT upgrading your systems, but still fuzzy on the attack vector if this test requires I upload a cgi script

No, DHCP has been proven vulnerable on some systems. So, a system can be exploited by this bug just by connecting to a LAN (e.g. wifi network).

Any protocol or service that runs via BASH is vulnerable. CGI is currently the largest and easiest attack vector to test for.

So assuming it's an online EC2 server LAMP stack with an empty cgi folder and a lone html page with hello world. Is that vulnerable to this exploit?

Yes.

remotely? how?