CVE-2017-17562
Embedthis GoAhead Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
7Exploited in Wild
YesDecision
Descriptions
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
Embedthis GoAhead en versiones anteriores a la 3.6.5 permite la ejecución remota de código si CGI está habilitado y se enlaza dinámicamente un programa CGI. Esto es el resultado de inicializar el entorno de scripts CGI bifurcados empleando parámetros de petición HTTP no fiables en la función cgiHandler en cgi.c. Al combinarse con el enlazador dinámico glibc, se puede abusar de este comportamiento para ejecutar código de manera remota mediante nombres de parámetro especiales como LD_PRELOAD. Un atacante puede realizar POST con su carga útil de objeto compartido en el cuerpo de la petición y referenciarla empleando /proc/self/fd/0.
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-12-12 CVE Reserved
- 2017-12-12 CVE Published
- 2017-12-27 First Exploit
- 2021-12-10 Exploited in Wild
- 2022-06-10 KEV Due Date
- 2024-07-25 EPSS Updated
- 2024-08-05 CVE Updated
CWE
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://www.securitytracker.com/id/1040702 | Broken Link | |
| https://github.com/elttam/advisories/tree/master/CVE-2017-17562 | Broken Link | |
| https://github.com/embedthis/goahead/issues/249 | Broken Link |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/43360 | 2024-08-05 | |
| https://www.exploit-db.com/exploits/43877 | 2024-08-05 | |
| https://github.com/ivanitlearning/CVE-2017-17562 | 2019-11-02 | |
| https://github.com/1337g/CVE-2017-17562 | 2017-12-27 | |
| https://github.com/freitzzz/bash-CVE-2017-17562 | 2021-11-17 | |
| https://github.com/crispy-peppers/Goahead-CVE-2017-17562 | 2019-11-23 | |
| https://www.elttam.com.au/blog/goahead | 2024-08-05 |
| URL | Date | SRC |
|---|---|---|
| http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html | 2024-07-24 | |
| https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74 | 2024-07-24 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Embedthis Search vendor "Embedthis" | Goahead Search vendor "Embedthis" for product "Goahead" | < 3.6.5 Search vendor "Embedthis" for product "Goahead" and version " < 3.6.5" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Integrated Lights Out Manager Search vendor "Oracle" for product "Integrated Lights Out Manager" | 3.0 Search vendor "Oracle" for product "Integrated Lights Out Manager" and version "3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Integrated Lights Out Manager Search vendor "Oracle" for product "Integrated Lights Out Manager" | 4.0 Search vendor "Oracle" for product "Integrated Lights Out Manager" and version "4.0" | - |
Affected
| ||||||