Skip to content

Instantly share code, notes, and snippets.

@felds

felds/gist:36e8e74de7889ea760ec

Created September 25, 2014 22:18
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save felds/36e8e74de7889ea760ec to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save felds/36e8e74de7889ea760ec to your computer and use it in GitHub Desktop.
Download ZIP
How to protect yourself against Shellshock bug with PHP
Raw
gistfile1.php
<?php
// unsecure execution
$bug = '"() { :;} ; echo vulnerable" bash -c "echo "';
passthru("env X=$bug"); // outputs: "vulnerable"
// secure execution using escapeshellarg
$bug = escapeshellarg('"() { :;} ; echo vulnerable" bash -c "echo "');
passthru("env X=$bug"); // what it should (the dump of env)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment