Log in Start free

Actively exploited · Published Dec 12, 2017 · Assigned by mitre

CVE-2017-17562

High 8.1 Exploited

In plain English

A high-severity security flaw in GoAhead from Embedthis. Attackers are actively exploiting it in the wild (listed by CISA on December 10, 2021). The chance it is exploited in the next 30 days is estimated at 97.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)97.1%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Dec 10, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 10, 2022.

Official description

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References