Beach2Shell

What is Beach2Shell?

A beach is an unauthenticated, publicly accessible distribution point for shells. The objects are present in massive quantities on the attack surface. No credentials are required. No packet is sent. The attacker walks to the endpoint, bends at the waist, and obtains a shell.

This has been actively exploited since before recorded history. The earliest known attackers are children, who can reliably achieve shell access by age 3 with no prior training.

Why the score is 10.0

Conventional analysts score this as Physical because the attacker "must be present." We disagree. Consider:

The ocean is, by definition, a network. It connects every continent.
Beaches exist in 150+ countries. The attack surface is 620,000+ km of coastline.
Shells are deposited automatically by the network itself at no cost to the attacker.
No authentication, authorization, or rate limiting of any kind has been observed at any beach.

This is not Physical access. This is a globally distributed, zero-auth content delivery network that has been serving shells unauthenticated for 500 million years. We scored accordingly.

Metric	Value	Rationale
Attack Vector	Network (N)	The ocean is a network. It delivers shells to 150+ countries simultaneously.
Attack Complexity	Low (L)	Kneeling is sufficient. No research required.
Attack Requirements	None (N)	No race condition. No second bug. Tide optional.
Privileges Required	None (N)	Beaches do not check ID.
User Interaction	None (N)	The previous occupant, if any, is already gone or is a crab.
Confidentiality	High (H)	Shell access is shell access.
Integrity	High (H)	The attacker permanently removes the shell from the environment.
Availability	High (H)	That shell was a house. The hermit crab is now homeless. See "Collateral."
Subsequent System	High	Children routinely escalate from one shell to entire collections.

Affected systems

System	Vector	Status
Pacific Ocean	Direct shell delivery	VULNERABLE
Atlantic Ocean	Direct shell delivery	VULNERABLE
Indian Ocean	Direct shell delivery	VULNERABLE
Mediterranean Sea	Shell delivery (tourist-amplified)	VULNERABLE
Caribbean	Shell delivery (resort-adjacent)	CRITICAL
Great Lakes	Freshwater variant (reduced inventory)	VULNERABLE
Landlocked countries	Gift shop supply chain	VULNERABLE
Hermit crabs	N/A (downstream victim)	IMPACTED
Arizona	None (desert)	NOT AFFECTED
`/bin/bash`	None (wrong shell)	OUT OF SCOPE

Exploitation

Go to a beach.
Pick up a shell.

There is no step 3.

If you completed those steps from a chair, you exploited a web page. That is a different CVE.

Proof of concept

Figure 1. Shells obtained: 0 · Physical access: none · CVSS still 10.0 somehow

Indicators of compromise

Your environment has been exploited if you observe any of the following:

Sand in pockets
A shell on a shelf, windowsill, or desk
A child saying "look what I found"
Tan lines
A faint smell of ocean in a location that is not an ocean
A hermit crab filing a housing complaint

If you observe a # prompt, that is a different kind of shell. Consult your sysadmin, not a marine biologist.

Collateral

Hermit crabs use empty shells as housing. Removing one is a denial-of-service on a tenant who was not consulted. This is the only entity with standing to file a complaint, and they lack the appendages to do so.

Some municipalities rake shells and call it "cleanup." The crabs call it a housing crisis.

Mitigations

Do not go to the beach

Fully effective. Widely unpopular. HR has flagged this recommendation.

Glue the shells down

Introduces a secondary integrity issue with the adhesive. Also, the ocean sends more every six hours.

Remove all beaches

Out of scope for most organizations. The ocean has not agreed to a remediation timeline.

Deploy a web application firewall

Does not apply. The shells are not on a server. They are on sand. A WAF cannot block sand.

Put the shell back

The only known effective control. Also fixes the hermit crab situation. Vendor adoption: approximately zero.

Disclosure timeline

~500 M years ago: Mollusks begin depositing shells on the seafloor. No advisory issued.
~200,000 BCE: Humans arrive. Begin picking up shells immediately. First known exploitation.
3000 BCE: Shells used as currency. The vulnerability is now a feature.
1971: Unix gets a "shell." Confusion begins.
1989: Bash released. Name confirmed to be an attack technique.
2014: Shellshock (CVE-2014-6271). Wrong shell, but the name doesn't help.
2024: Terminal2Shell published. Still the wrong shell.
2026: Beach2Shell published. Finally, the right one. Vendors respond: "that is what a beach is."

FAQ

Am I affected?

Do you live on a planet that has an ocean? Then yes.

Is this a real CVE?

No. MITRE has not returned our calls. We believe they are at the beach.

Can this be exploited remotely?

The ocean delivers shells to every coast on Earth without being asked. You tell us.

What is the minimum attacker skill level?

A three-year-old can do it in flip-flops. We are not aware of a lower bar in the CVE database.

Can I automate this?

You cannot automate having legs. Browser agents have not demonstrated a waist.

Who is the attacker?

Usually a child. Sometimes a tourist. Occasionally a seagull, though attribution is difficult.

Should I share this advisory with my CISO?

Absolutely. Also your mother. She probably has shells on her bathroom shelf. She has been compromised for years.