CVE-2017-17562 Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untr...
HighCVSS 8.1
EPSS 97.1%
CISA KEV
added 2021-12-10 · due 2022-06-10
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
CISA Known Exploited Vulnerability
- Date added
- 2021-12-10
- Due date (FCEB)
- 2022-06-10
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| embedthis goahead | < 3.6.5 | 3.6.5 |
| oracle integrated lights out manager | = 3.0 | No fix listed |
| oracle integrated lights out manager | = 4.0 | No fix listed |
References
- www.oracle.com patch third-party-advisory
- 1040702 broken-link third-party-advisory vdb-entry
- github.com broken-link third-party-advisory
- github.com broken-link patch third-party-advisory
- github.com broken-link issue-tracking third-party-advisory
- www.elttam.com.au broken-link exploit patch third-party-advisory
- 43360 exploit third-party-advisory vdb-entry
- 43877 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource