Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vulnerability record

CVE-2017-17562

Embedthis GoAhead Remote Code Execution Vulnerability

HighExploitation confirmedCISA KEV
What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run GoAhead, fix it now.

CISA required action: Apply updates per vendor instructions.

US federal civilian agencies must remediate by Jun 10, 2022.

Patch status

Official fix available since

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Description

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

ProductVendorAffected versionsFixed inSource
GoAheadEmbedthis< 3.6.53.6.5KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdateKEV

    CVE-2017-17562 scored CVSS 8.1: Embedthis GoAhead, Embedthis GoAhead Remote Code Execution Vulnerability

    CISA lists this as exploited in the wild. Unpatched GoAhead systems are exposed to active attacks now.

    Basis: NIST National Vulnerability Database

  2. Patch releasedUpdateKEV

    Patch released for CVE-2017-17562: Embedthis GoAhead, Embedthis GoAhead Remote Code Execution Vulnerability

    An official fix is now available for Embedthis GoAhead. This vulnerability is being exploited, so apply it promptly.

    Basis: NVD patch reference

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

  • nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2017-17562
  • oracle.com http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
  • securitytracker.com http://www.securitytracker.com/id/1040702
  • github.com https://github.com/elttam/advisories/tree/master/CVE-2017-17562
  • github.com https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74
  • github.com https://github.com/embedthis/goahead/issues/249
  • elttam.com.au https://www.elttam.com.au/blog/goahead/
  • exploit-db.com https://www.exploit-db.com/exploits/43360/
  • exploit-db.com https://www.exploit-db.com/exploits/43877/
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-17562