CVE-2017-17562

    Dashboard / Vulnerabilities / CVE-2017-17562

    CVE-2017-17562

    Published: 12 Dec 2017Last Modified: 10 Mar 2026

    Summary:

    Details: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

    References: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-17562, , https://github.com/elttam/advisories/tree/master/CVE-2017-17562, http://www.securitytracker.com/id/1040702, https://github.com/embedthis/goahead/issues/249, https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74, https://www.elttam.com.au/blog/goahead/, http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html, https://www.exploit-db.com/exploits/43360/, https://www.exploit-db.com/exploits/43877/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High