ZeroDay Findings
Sign inSign up

Findings

CVE-2017-17562

Embedthis GoAhead Remote Code Execution Vulnerability

Published Dec 12, 2017 · updated Jun 16, 2026 · embedthis goahead

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 12, 2017 · Catalog

    Detected

    Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names suc

  2. Dec 10, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 10, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names suc

Required action

Apply updates per vendor instructions.

CISA due date Jun 10, 2022

Affected

  • cpe embedthis/goaheadversion unspecified
  • cpe oracle/integrated lights out manager3.0
  • cpe oracle/integrated lights out manager4.0
  • vendor Embedthis GoAheadversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2017-17562

    Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2017-17562

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2017-17562

    30-day exploitation probability 96.3%

    first.org
  • Exploit DatabasePublic exploit reference43360

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference43877

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_linux/http/goahead_ldpreload

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2017-17562

    Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined

    nvd.nist.gov

References