It allows arbitrary code execution if an attacker can modify environment variables through other software.
Most webservers put certain HTTP headers in environment variables. I can certainly see the how this could be exploited.
Most webservers put certain HTTP headers in environment variables. I can certainly see the how this could be exploited.
I legitimately don't understand why they might do such a thing. Can you explain?
Not to say nobody will be bitten by that, but I don't think that's going to be all that widespread.
CGI apps execute shell scripts all the time. Even if an app executes an app executes an app executes an app, if that app four layers down runs a shell script, the environment is still passed down. Turtles, dude.