Can you give an example of an exploit in bash? The link you give is excellent information, but doesn't have any shell script examples.

My first thought: It seems like only $@, $* and variables read from the environment could be possible attack vectors. But since shell scripts can't be setuid, it's hard for me to immediately imagine how unquoting could enable a new exploit.

EDIT: the most dangerous example I can think of right now is a script like this, where a webapp invokes the script and passes a GET param as an argument:

  #!/bin/bash
  exec $1

But if I execute this like so:

  ./badscript.sh 'some-benign-command ; cat /etc/passwd'

... then passwd is not exposed, because the tokens ";", "cat" and "/etc/passwd" are passed into the argv of some-benign-command.

(And if "cat /etc/password" itself can be passed as $1, then quoting won't help...)