PT-2022-11443 · Goahead · Goahead Web Server

Published 2022-08-08 · Updated 2022-08-12 · CVE-2021-41615

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoAhead WebServer version 2.1.8

Description The issue arises from insufficient nonce entropy in the websda.c file of GoAhead WebServer. This is due to the nonce calculation relying on a hardcoded value, onceuponatimeinparadise, which does not adhere to the secret-data guideline for HTTP Digest Access Authentication as specified in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). Although version 2.1.8 is from 2003, the affected code appears in multiple derivative works that may still be in use. Recent GoAhead software is unaffected.

Recommendations For GoAhead WebServer version 2.1.8, consider updating to a newer version where this issue is resolved, as recent GoAhead software is unaffected. If updating is not feasible, a potential temporary workaround could involve modifying the nonce calculation to use a more secure, secret value, though this would require careful consideration of the implementation details to ensure compliance with relevant standards. At the moment, there is no information about a specific newer version that contains a fix for this vulnerability.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2021-41615

Affected Products

Goahead Web Server

References · 5

• https://osv.dev/vulnerability/CVE-2021-41615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41615 · Security Note
• https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=true · Note
• https://devel.rtems.org/browser/rtems/cpukit/httpd/websda.c?rev=c1427d2758079f0e9dd6a8de1662d78e0d6bc4ca · Note
• https://t.me/cibsecurity/47759 · Telegram Post