1

How do I block Shellshock, also known as Bashdoor, in htaccess?

Using a Shared Host, add a Block for User-Agent: "uname"

Host: 46.105.126.165
Http Code:/?x=()
Date: Jun 26 07:38:49
Http Version: {Size in Bytes: };
Referer: echo
Status: 0
Agent: Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ HTTP/1.0 403 - () { :; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @ () { :; }; echo Content-type:text/plain;echo;echo;echo M`expr 1330 + 7`H;/bin/uname -a;echo @
Improve this question
21
  • Are you vulnerable??
    – closetnoc
    Commented Jun 27, 2015 at 0:22
  • I don't know? I tracked down what /?x=() was & scoured for htaccess code unsuccessfully.
    – user49378
    Commented Jun 27, 2015 at 1:05
  • Check out en.wikipedia.org/wiki/Shellshock_(software_bug) and pay attention to the CVE notices half way down. There are some tests you can run to know. You will want to check this. This is something that if not fixed right away you will not only get hacked in the worst way, but possibly destroyed.
    – closetnoc
    Commented Jun 27, 2015 at 1:10
  • I was forbidden 8) I changed my Hotlinking code back to RewriteCond from SetEnvIfNoCase for a Whitelisted no-hotlinking.gif may have made the difference?
    – user49378
    Commented Jun 27, 2015 at 1:24
  • 1
    My site appears secure for now - Thanks for all the advice 8)
    – user49378
    Commented Jun 27, 2015 at 5:16

1 Answer 1

Reset to default
1

Time for an official answer.

What I learned is that hackers like to try to exploit the shell shock bug with variants. They like to try to use lines containing (){} and ( ){:;} and similar, where the only differences for the most part are the number of spaces between each character.

It's a matter of when apache writes data to the system's environment table (for example: setting an environment variable such as REQUEST_URI) that counts. If apache writes data before processing the mod_rewrite module, then configuring .htaccess using RewriteRule directives will have no effect.

The best thing to do is to access SSH (server shell) and enter commands to see if your system is vulnerable and if it is, then it needs to be patched.

See https://access.redhat.com/articles/1200223 for instructions on commands to type into the shell.

If you are on shared hosting or you have no access to SSH or a shell, then contact the administrator of your hosting environment and tell them to check the server for the vulnerability and fix as necessary.

Since you are concerned about this, what you should do ASAP is back up every piece of valuable website content you have along with any databases you have running just in case a hacker ends up trashing the server.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.