PT-2019-17476 · Goahead · Goahead Web Server

Published 2019-11-27 · Updated 2022-06-17 · CVE-2019-5096

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoAhead web server versions v3.6.5, v4.1.1, v5.0.1

Description A code execution issue exists in the processing of multi-part/form-data requests within the base GoAhead web server application. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request, corrupting heap structures and potentially leading to full code execution. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.

Recommendations For version v3.6.5, update to a version that fixes the use-after-free condition in the processing of multi-part/form-data requests. For version v4.1.1, update to a version that fixes the use-after-free condition in the processing of multi-part/form-data requests. For version v5.0.1, update to a version that fixes the use-after-free condition in the processing of multi-part/form-data requests.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2019-5096

Affected Products

Goahead Web Server

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0888 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5096 · Security Note
• https://t.me/cybersecuritytechnologies/465 · Telegram Post
• https://t.me/thehackernews/548 · Telegram Post