Complex sentence: While Bash is not an Internet-facing service, many Internet-facing daemons call it internally, allowing an attacker to use an Internet-facing service that sets the contents of an environmental variable to have Bash execute the commands in the variable.
Split into simpler sentences: While Bash is not an Internet-facing service, many Internet-facing daemons call Bash internally. An attacker can use an Internet-facing service that sets the contents of an environmental variable to cause Bash to execute the commands in the variable.