CVE-2017-17562
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Embedthis GoAhead Remote Code Execution Vulnerability.
- Added
- 10 Dec 2021
- Fix due (US federal)
- 10 Jun 2022
- Used by ransomware
- Not known
Apply updates per vendor instructions.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 97.1% · top 0.1% of all CVEs (4 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
- n/a
- CWE-noinfo Not enough information
Affected products
n/a
- affected n/a
References (9)
- https://github.com/elttam/advisories/tree/master/CVE-2017-17562 (opens in a new tab)x_refsource_MISCx_transferred
- 1040702 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- https://www.elttam.com.au/blog/goahead/ (opens in a new tab)x_refsource_MISCx_transferred
- 43360 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/embedthis/goahead/issues/249 (opens in a new tab)x_refsource_MISCx_transferred
- 43877 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-17562 (opens in a new tab)government-resource
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-17562)Record last updated .