PT-2017-3348 · Gnu+1 · Glibc+1

Daniel Hodson · Published 2017-06-08 · Updated 2025-11-16 · CVE-2017-17562

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Embedthis GoAhead versions prior to 3.6.5

Description The issue is related to the initialization of the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function. This can be abused for remote code execution when combined with the glibc dynamic linker, using special parameter names such as LD PRELOAD. An attacker can send a shared object payload in the body of a request and reference it using /proc/self/fd/0. The vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted HTTP request that includes parameters with the "LD " prefix, which are used to create environment variables.

Recommendations For Embedthis GoAhead versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider disabling the cgiHandler function or restricting the use of dynamically linked CGI programs until a patch is available. Additionally, restrict access to the LD PRELOAD parameter to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2018-00118

CVE-2017-17562

Affected Products

Embedthis Goahead

Glibc

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/goahead_ldpreload.rb · Exploit
• 🔥 https://github.com/elttam/advisories/tree/master/CVE-2017-17562 · Exploit
• 🔥 https://github.com/ivanitlearning/CVE-2017-17562 · Exploit
• 🔥 https://github.com/nu11pointer/goahead-rce-exploit · Exploit
• 🔥 https://github.com/fssecur3/goahead-rce-exploit · Exploit
• 🔥 https://elttam.com.au/blog/goahead · Exploit
• 🔥 https://exploit-db.com/exploits/43360 · Exploit
• 🔥 https://exploit-db.com/exploits/43877 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-17562 · Security Note
• ❌ https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74 · Patch, Deleted
• https://osv.dev/vulnerability/CVE-2017-17562 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00118 · Security Note
• http://oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html · Patch
• http://securitytracker.com/id/1040702 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-17562 · Note