CVE-2017-17562

Embedthis GoAhead web servers before version 3.6.5 initialize the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function (cgi.c), which allows an attacker to inject dynamic-loader variables such as LD_PRELOAD when CGI is enabled and the CGI program is dynamically linked. By POSTing a shared-object payload in the request body and referencing it through /proc/self/fd/0, the attacker causes the glibc dynamic linker to load and execute their code, resulting in unauthenticated remote code execution with the privileges of the web server. The attack requires no privileges or user interaction, but only works on targets with CGI enabled and a dynamically linked CGI binary, which limits the exploitable share of GoAhead's very large embedded-device footprint. Affected deployments include Embedthis GoAhead prior to 3.6.5 across embedded and IoT devices, as well as Oracle Integrated Lights Out Manager (ILOM) service processors that ship the affected GoAhead code. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2021-12-10, and EPSS assigns a 96.3% probability of exploitation within 30 days.

What to do: Upgrade Embedthis GoAhead to version 3.6.5 or later per vendor instructions, and apply the ILOM updates Oracle provides in its security advisories for Integrated Lights Out Manager. Where upgrading is not immediately possible, disable CGI or ensure CGI programs are statically linked so LD_PRELOAD cannot be abused, and prioritize patching internet-exposed devices. Because this vulnerability is on the CISA KEV catalog, use asset inventories and exposure scans to confirm no remaining unpatched GoAhead instances are reachable from the internet.