CVE-2017-17562

CVSS 8.1 HIGHEPSS 96.3%● KEV

In short

GoAhead web server versions before 3.6.5 allow attackers to run malicious code on the server if CGI is enabled. The vulnerability happens because the server passes untrusted user input as environment variables to CGI scripts, which can be exploited using techniques like LD_PRELOAD to load malicious libraries.

Technical detail

CVE-2017-17562 is a remote code execution vulnerability in Embedthis GoAhead <3.6.5 affecting CGI-enabled deployments with dynamically linked CGI programs. The cgiHandler function in cgi.c improperly initializes the forked child process environment using unsanitized HTTP request parameters, allowing attackers to inject dangerous linker variables (e.g., LD_PRELOAD) that glibc will process, enabling arbitrary code execution via crafted POST requests referencing /proc/self/fd/0.

Summary generated and translated by AI from the official description.

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 9

githubgithub.com/ivanitlearning/CVE-2017-17562★ 9 githubgithub.com/nu11pointer/goahead-rce-exploit★ 8 githubgithub.com/joaomagfreitas/bash-CVE-2017-17562★ 1 githubgithub.com/1337g/CVE-2017-17562★ 1 githubgithub.com/crispy-peppers/Goahead-CVE-2017-17562★ 0 cve_referencewww.exploit-db.com/exploits/43360/unverified exploitdbwww.exploit-db.com/exploits/43360unverified exploitdbwww.exploit-db.com/exploits/43877unverified cve_referencewww.exploit-db.com/exploits/43877/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/elttam/advisories/tree/master/CVE-2017-17562 https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74 https://github.com/embedthis/goahead/issues/249 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-17562 https://www.elttam.com.au/blog/goahead/https://www.exploit-db.com/exploits/43360/https://www.exploit-db.com/exploits/43877/http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://www.securitytracker.com/id/1040702