# Trouble with quoting a shellshock test

**URL:** <https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363>\
**Category:** Ansible Project\
**Created:** [September 27, 2014, 2:00am UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363 "2014-09-27T02:00:57Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_Casey](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@Mark\_Casey](https://forum.ansible.com/u/Mark_Casey)\
**Post date:** [September 27, 2014, 2:00am UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363/1 "2014-09-27T02:00:57Z")

</div>

I’m trying to write an Ansible task to check for both CVE-2014-6271 and CVE-2014-7169 as I haven’t been able to find one pre-made.

This command should check both but for the life of me I can’t get the escaped single quote past the parser… I’ve tried some variants of “shell: \>” and “shell: |” but no dice.

> - name: Check for shellshock fix (checks for both CVE-2014-6271 and CVE-2014-7169)  
> shell: cd /tmp && rm -f /tmp/echo && env ‘x=() { :;}; echo vulnerable’ 'f=() { (a)=\>' bash -c ‘echo echo vulnerable’; cat echo  
> args:  
> executable: /bin/bash  
> sudo: no  
> register: shellshock\_result2  
> changed\_when: False  
> failed\_when: “‘vulnerable’ in shellshock\_result2.stderr”

This version gives:

> ````auto
> 
> ```
> ERROR: There was an error while parsing the task "shell cd /tmp && rm -f /tmp/echo && env 'x=() { :;}; echo vulnerable' 'f=() { (a)=>\\' bash -c 'echo echo vulnerable'; cat echo".
> Make sure quotes are matched or escaped properly
> ```
> 
> ````

I’m assuming the issue is that, if I understand correctly, the second exploit partly depends on the mismatched quote arriving unharmed(?) and YAML thinks that is bad(?).

Anyone have any ideas or should I just copy it over as a script and run that?

Thank you,  
Mark

---

<div class="post-metadata">

**Author:** ![Mark\_Casey](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@Mark\_Casey](https://forum.ansible.com/u/Mark_Casey)\
**Post date:** [September 27, 2014, 2:02am UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363/2 "2014-09-27T02:02:40Z")

</div>

Oh… the official source of the commands was: [https://access.redhat.com/articles/1200223](https://access.redhat.com/articles/1200223), but someone was nice enough to combine them in: [https://bugzilla.redhat.com/show\_bug.cgi?id=1141597#c47](https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c47)

---

<div class="post-metadata">

**Author:** ![Igor\_Homyakov](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@Igor\_Homyakov](https://forum.ansible.com/u/Igor_Homyakov)\
**Post date:** [September 27, 2014, 7:04am UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363/3 "2014-09-27T07:04:21Z")

</div>

Hi Mark,

I think this is not a good idea to use one liner such that. There are  
many players except bash interpreter, yaml parser, python string  
quotation and so forth. I would recommend you to you use a bash script  
in this case

I've made a simple role, it is based and code samples you provided I  
hope you will find it useful  
[https://github.com/hostmaster/check\_shellshock](https://github.com/hostmaster/check_shellshock)

-- Best, Igor

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [September 27, 2014, 2:18pm UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363/4 "2014-09-27T14:18:21Z")

</div>

I’m a big fan of the “script” module when you need to push and run a tiny shell script.

[http://docs.ansible.com/script\_module.html](http://docs.ansible.com/script_module.html)

---

<div class="post-metadata">

**Author:** ![Igor\_Homyakov](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@Igor\_Homyakov](https://forum.ansible.com/u/Igor_Homyakov)\
**Post date:** [September 28, 2014, 8:40am UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363/5 "2014-09-28T08:40:31Z")

</div>

Absolutely it fitted perfectly

– Best, Igor

---

<div class="post-metadata">

**Author:** ![Mark\_Casey](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@Mark\_Casey](https://forum.ansible.com/u/Mark_Casey)\
**Post date:** [September 29, 2014, 12:13am UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363/6 "2014-09-29T00:13:22Z")

</div>

Thanks to both for the suggestions.

Mark

---

<div class="post-metadata">

**Author:** ![Igor\_Homyakov](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@Igor\_Homyakov](https://forum.ansible.com/u/Igor_Homyakov)\
**Post date:** [September 29, 2014, 8:36am UTC](https://forum.ansible.com/t/trouble-with-quoting-a-shellshock-test/16363/7 "2014-09-29T08:36:17Z")

</div>

Have a look a the script  
[https://github.com/hannob/bashcheck/blob/master/bashcheck](https://github.com/hannob/bashcheck/blob/master/bashcheck)  
it seems to me it covers all know shelshock CVE