Reputation: 12581
This ycombinator thread states that
env X='() { (a)=>\' sh -c "echo date"
allows you to drop the first token, and then run the result, sending the output to the dropped token. I can see that the magic is in the () { (a)=>\'
part, but this is quite a hard thing to search for, so it would be great if someone could explain the inner workings.
In the linked possible duplicate question, a variable is exported to an environment variable by using,
env X="() { :;} ;
which really is not the same as
env X='{ (a)=>\'
which is the part I am trying to understand the workings off. So, what do the (a)
and =>\'
parts do? Clearly, it is doing something very similar, but is different in that it got around the first patch to this vulnerability, see comments by chepner.
Upvotes: 18
Views: 850