Talos experts found a critical RCE in GoAhead Web Server
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-17562 | Unauthenticated RCE in Embedthis GoAhead Web Server via CGI LD_PRELOAD injection Embedthis GoAhead web servers before version 3.6.5 initialize the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function (cgi.c), which allows an attacker to inject dynamic-loader variables such as LD_PRELOAD when CGI is enabled and the CGI program is dynamically linked. By POSTing a shared-object payload in the request body and referencing it through /proc/self/fd/0, the attacker causes the glibc dynamic linker to load and execute their code, resulting in unauthenticated remote code execution with the privileges of the web server. The attack requires no privileges or user interaction, but only works on targets with CGI enabled and a dynamically linked CGI binary, which limits the exploitable share of GoAhead's very large embedded-device footprint. Affected deployments include Embedthis GoAhead prior to 3.6.5 across embedded and IoT devices, as well as Oracle Integrated Lights Out Manager (ILOM) service processors that ship the affected GoAhead code. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2021-12-10, and EPSS assigns a 96.3% probability of exploitation within 30 days. Do: Upgrade Embedthis GoAhead to version 3.6.5 or later per vendor instructions, and apply the ILOM updates Oracle provides in its security advisories for Integrated Lights Out Manager. Where upgrading is not immediately possible, disable CGI or ensure CGI programs are statically linked so LD_PRELOAD cannot be abused, and prioritize patching internet-exposed devices. Because this vulnerability is on the CISA KEV catalog, use asset inventories and exposure scans to confirm no remaining unpatched GoAhead instances are reachable from the internet. | 8.1 | 96% | KEV PoC ×3 |
| mass~hundreds of thousands of internet-exposed GoAhead/IoT devices (only the subset with CGI enabled and dynamically linked binaries is actually exploitable) | |
| CVE-2019-5096 +1 in the same advisory: …5097 | An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server. NVD description · AI analysis pending | 9.8 group max | 67% | PoC |
| — |
Full article412 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 04, 2019
Experts at Cisco Talos found two vulnerabilities in the GoAhead embedded web server, including a critical remote code execution flaw.
GoAhead is the world’s most popular, tiny embedded web server. It is developed by EmbedThis that defines it as compact, secure and simple to use. GoAhead is deployed in hundreds of millions of devices and is ideal for the smallest of embedded devices. Searching for GoAhead installs exposed online with Shodan search engine, at the time of writing there are over 1.3 million installs.
The first vulnerability, tracked as CVE-2019-5096, is related to how multi-part/form-data requests are processed. The flaw could be exploited by an unauthenticated attacker to trigger a use-after-free condition and execute arbitrary code on the server by sending specially crafted HTTP requests.
“An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution.” reads the security advisory published by Talos. “The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.”
The security flaw has been assigned a CVSS score of 9.8.
The second vulnerability in the GoAhead web server found by Talos, tracked as CVE-2019-5097, can be exploited by an unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted HTTP requests.
“A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process.” continues the post. “The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.”
According to Talos, GoAhead versions 5.0.1, 4.1.1 and 3.6.5 are affected by the two vulnerabilities. Talos reported the flaws to EmbedThis in August, and the vendor addressed them on November 21.
In December 2017, experts from Elttam discovered a flaw in GoAhead tiny web server, tracked as CVE-2017-17562, that affects hundreds of thousands IoT devices. The flaw could be exploited to remotely execute malicious code on affected devices.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Hacking, GoAhead)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/94692/hacking/goahead-rce.html