Shellshock in Cockroachdb

Detecting a Shellshock‑prone configuration in a CockroachDB deployment focuses on two observable surfaces:

1. Unauthenticated API endpoints that forward user input to shell commands. middleBrick’s unauthenticated black‑box scan will probe such endpoints with typical injection payloads (e.g., ;id, $(whoami)) as part of its Input Validation check. If the endpoint returns a response that indicates command execution (different status code, output in body, or timing variation), the finding is reported with severity high or critical depending on the presence of authentication.
2. Environment variable exposure. middleBrick can also detect whether HTTP headers or query strings are being copied into outgoing processes’ environments. By sending specially crafted headers (e.g., User-Agent: () { :;}; /bin/bash -c 'id') and observing whether the response changes, the scanner can infer that the header is being interpreted by a downstream shell.

When middleBrick runs its 12 parallel checks, the relevant ones for this scenario are:

• Input Validation – looks for unsanitized reflection of user‑supplied data in responses.
• Authentication – confirms whether the endpoint is reachable without credentials, which raises the impact.
• Data Exposure – may reveal command output in error messages or logs.

The scanner does not need to know internal CockroachDB code; it treats the service as a black box and reports any behavior consistent with command injection via environment variables.

A sample finding from middleBrick might look like:

{
  "endpoint": "https://api.example.com/v1/backup",
  "method": "POST",
  "parameter": "database",
  "payload": "; export VAR='() { :;}; /bin/bash -c \"id\"'",
  "evidence": "Response contains 'uid=0(root) gid=0(root) groups=0(root)'",
  "severity": "critical",
  "remediation": "Avoid building shell commands with user input; use exec.Command with argument list or CockroachDB native BACKUP statement."
}

The most reliable way to eliminate the Shellshock risk in a CockroachDB context is to remove any path where user‑controlled data reaches a Bash interpreter. CockroachDB provides native facilities that make shell invocation unnecessary for common operational tasks.

1. Use CockroachDB’s built‑in BACKUP/RESTORE statements instead of shelling out to the cockroach CLI. These statements are executed purely inside the SQL layer and do not spawn external processes.

-- Safe: perform a backup via SQL
BACKUP DATABASE mydb TO 'azure://mycontainer/mybackup?connection_string' WITH snapshot;

2. If external tooling is unavoidable, invoke it with os/exec using an argument vector, never a shell. This prevents the environment from being interpreted by Bash.

import (
    "os/exec"
)

func runBackupSafely(dbName string) error {
    // ✅ Safe: arguments are passed directly, no shell interpretation
    cmd := exec.Command(
        "cockroach",
        "backup",
        dbName,
        "--store=azure://mycontainer/mybackup?connection_string",
    )
    // Optional: restrict environment to a known safe set
    cmd.Env = []string{
        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
        "HOME=/tmp",
    }
    return cmd.Run()
}

3. Sanitize or whitelist any environment variables that originate from external sources (HTTP headers, request parameters). Only set variables that are explicitly needed and validate their content against a strict allow‑list (e.g., alphanumeric plus hyphens/underscores).

func safeSetEnv(key, val string) {
    // Allow only alphanumerics, dash, underscore
    if matched, _ := regexp.MatchString(`^[A-Za-z0-9_-]+$`, val); !matched {
        return // reject unsafe value
    }
    os.Setenv(key, val)
}

// Example usage when reading a header for a backup target
if val := r.Header.Get("X-Backup-Target"); val != "" {
    safeSetEnv("BACKUP_TARGET", val)
}

4. Least‑privilege execution. Run the CockroachDB processes and any helper scripts under a non‑root user with limited capabilities. Even if Shellshock were triggered, the attacker would gain only the privileges of that confined account.

By combining these practices—preferring native SQL commands, avoiding shell interpretation, strictly controlling environment variables, and running with reduced privileges—the attack surface for Shellshock in a CockroachDB deployment is effectively eliminated.