I was able to use the bash shellshock vulnerability last week to manually find a vulnerability in a web server through the HTTP User-agent. If you can do something manually there is a good chance that it can be done programmatically. This python program is an extension of that belief.
more here.............http://securenetworkmanagement.com/shellshock-user-agent-vulnerability-scanner/
more here.............http://securenetworkmanagement.com/shellshock-user-agent-vulnerability-scanner/