CVE-2017-17562: Embedthis GoAhead Remote Code Execution Vulnerability
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LDPRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Embedthis GoAheadto a version that resolves this vulnerability.Fixed in 3.6.5 - Configuration
Disable CGI in Embedthis GoAhead to prevent exploitation of the remote code execution issue when CGI is enabled and a CGI program is dynamically linked.
Embedthis GoAhead CGI CGI enabled = false - Compensating control
If you cannot immediately disable CGI, restrict inbound access to the GoAhead server (e.g., via network ACL/firewall) to reduce exposure to HTTP requests that carry attacker-controlled parameters for the cgiHandler environment initialization.
Event History
Frequently Asked Questions
What is CVE-2017-17562?
CVE-2017-17562 is a vulnerability in Embedthis GoAhead before version 3.6.5 that allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
How severe is CVE-2017-17562?
CVE-2017-17562 has a severity rating of 8.1 (high).
How does CVE-2017-17562 work?
CVE-2017-17562 works by initializing the environment of forked CGI scripts using untrusted HTTP request parameters, allowing for remote code execution.
What software is affected by CVE-2017-17562?
Embedthis GoAhead before version 3.6.5 is affected by CVE-2017-17562.
How can I fix CVE-2017-17562?
To fix CVE-2017-17562, update Embedthis GoAhead to version 3.6.5 or later.