Shellshock: When HTTP Headers Execute Linux Commands

Shellshock, a 2014 vulnerability, demonstrated that HTTP headers could be weaponized to execute arbitrary commands on Linux servers by exploiting how Bash processes environment variables. The flaw emerged in the trust chain between web protocols and operating systems: CGI applications passed HTTP header data as environment variables, which Bash would interpret as executable code. This vulnerability fundamentally reshaped how developers approach input validation and shell security.