High severity · published Dec 12, 2017
CVE-2017-17562
Embedthis GoAhead Remote Code Execution Vulnerability
In wildKEV
8.1
CVSS
97.1%
EPSS
Yes
On KEV
Description
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)97.1% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 10, 2021
Federal remediation dueJun 10, 2022
Ransomware campaign useNot known
Affected products
Which versions
GO
Goahead · Embedthis
before 3.6.5 · source: NVD, KEV
IL
Integrated Lights Out Manager · Oracle
3.0; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17562
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17562
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://github.com/elttam/advisories/tree/master/CVE-2017-17562
vdb-entry
http://www.securitytracker.com/id/1040702
x_refsource_MISC
https://www.elttam.com.au/blog/goahead/
exploit
https://www.exploit-db.com/exploits/43360/
x_refsource_CONFIRM
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
x_refsource_MISC
https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74
More from Goahead
9.8
CVE-2021-41615
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the…
9.8
CVE-2021-43298
The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting
9.8
CVE-2021-42342
An issue was discovered in GoAhead 4.x and 5.x before 5.1.5
9.8
CVE-2019-5096
An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1…
9.8
CVE-2017-1000471
EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service