CGI Applications
Directory map
Summary
Common Gateway Interface (CGI) is a legacy protocol for invoking external scripts from a web server. Scripts live in /cgi-bin/, run as a new OS process per request, and receive HTTP request data as environment variables. Though largely superseded by modern frameworks, CGI persists in embedded devices, IoT hardware, and unmaintained legacy servers — making it a recurring finding on internal and external assessments.
Shellshock (CVE-2014-6271) is the canonical CGI attack. It exploits a 25-year-old flaw in GNU Bash (≤ 4.3) where commands appended after a function definition in an environment variable are executed when Bash starts. Since CGI passes HTTP headers as environment variables, an attacker-controlled header (most commonly User-Agent) becomes the injection vector. The payload () { :; }; <command> causes the web server’s Bash process to execute <command> in the context of the web server user (www-data). Confirmation is straightforward with curl -H 'User-Agent: () { :; }; /bin/cat /etc/passwd' ...; escalation to a reverse shell requires only replacing the test command with a Bash TCP redirect. Shellshock is most commonly encountered on IoT devices and embedded appliances that have not received patches since 2014. Remediation is patching Bash; for systems that cannot be patched, network isolation and decommission evaluation are the appropriate responses.