CVE-2017-17562highunder attack

CVE-2017-17562

Published · Updated

Follow this CVE+ Monitor GoAhead

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 97%
from disclosure to weapon6 days
Published on NVDDec 12
1st PoC+6d
metasploit+6d
CISA KEV+1459d
Action required by CISAfederal deadline: 2022-06-10

Apply updates per vendor instructions.

In short

GoAhead web server versions before 3.6.5 allow attackers to run malicious code on the server if CGI is enabled. The vulnerability happens because the server passes untrusted user input as environment variables to CGI scripts, which can be exploited using techniques like LD_PRELOAD to load malicious libraries.

Technical detail

CVE-2017-17562 is a remote code execution vulnerability in Embedthis GoAhead <3.6.5 affecting CGI-enabled deployments with dynamically linked CGI programs. The cgiHandler function in cgi.c improperly initializes the forked child process environment using unsanitized HTTP request parameters, allowing attackers to inject dangerous linker variables (e.g., LD_PRELOAD) that glibc will process, enabling arbitrary code execution via crafted POST requests referencing /proc/self/fd/0.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.