Experts discovered a flaw in GoAhead that affects hundreds of thousands IoT devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-17562 | Unauthenticated RCE in Embedthis GoAhead Web Server via CGI LD_PRELOAD injection Embedthis GoAhead web servers before version 3.6.5 initialize the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function (cgi.c), which allows an attacker to inject dynamic-loader variables such as LD_PRELOAD when CGI is enabled and the CGI program is dynamically linked. By POSTing a shared-object payload in the request body and referencing it through /proc/self/fd/0, the attacker causes the glibc dynamic linker to load and execute their code, resulting in unauthenticated remote code execution with the privileges of the web server. The attack requires no privileges or user interaction, but only works on targets with CGI enabled and a dynamically linked CGI binary, which limits the exploitable share of GoAhead's very large embedded-device footprint. Affected deployments include Embedthis GoAhead prior to 3.6.5 across embedded and IoT devices, as well as Oracle Integrated Lights Out Manager (ILOM) service processors that ship the affected GoAhead code. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities Catalog on 2021-12-10, and EPSS assigns a 96.3% probability of exploitation within 30 days. Do: Upgrade Embedthis GoAhead to version 3.6.5 or later per vendor instructions, and apply the ILOM updates Oracle provides in its security advisories for Integrated Lights Out Manager. Where upgrading is not immediately possible, disable CGI or ensure CGI programs are statically linked so LD_PRELOAD cannot be abused, and prioritize patching internet-exposed devices. Because this vulnerability is on the CISA KEV catalog, use asset inventories and exposure scans to confirm no remaining unpatched GoAhead instances are reachable from the internet. | 8.1 | 96% | KEV PoC ×3 |
| mass~hundreds of thousands of internet-exposed GoAhead/IoT devices (only the subset with CGI enabled and dynamically linked binaries is actually exploitable) |
Full article446 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 25, 2017
Experts from Elttam discovered a flaw in GoAhead tiny web server that affects hundreds of thousands IoT devices, it could be exploited to remotely execute malicious code on affected devices.
A vulnerability in the GoAhead tiny web server package, tracked as CVE-2017-17562, affects hundreds of thousands of IoT devices. The GoAhead solution is widely adopted by tech giants, including Comcast, IBM, Boeing, Oracle, D-Link, ZTE, HP, Siemens, and Canon. It is easy to find the tiny web server in almost any IoT device, including printers and routers.
The vulnerability was discovered by experts from the security firm Elttam who devised a method to remotely execute malicious code on devices running the GoAhead web server package. The flaw affects all GoAhead versions before GoAhead 3.6.5.
“This blog post details CVE-2017-17562, a vulnerability which can be exploited to gain reliable remote code execution in all versions of the GoAhead web server < 3.6.5.” reads the analysis published by Elttam.
“The vulnerability is a result of Initialising the environment of forked CGI scripts using untrusted HTTP request parameters, and will affect all user’s who have CGI support enabled with dynamically linked executables (CGI scripts). This behavior, when combined with the glibc dynamic linker, can be abused for remote code execution using special variables such as LD_PRELOAD (commonly used to perform function hooking, see preeny).”
Attackers can exploit the vulnerability if the CGI support is enabled with dynamically linked CGI program. Unfortunately, this configuration is quite common.
Elttam reported the vulnerability to Embedthis, the company who developed the web server, that promptly released an update that addresses the flaw.
Now it is important that hardware manufacturers will include the patch in the instances of the GoAhead running into their products, but this process could take a lot of time.
To have an idea of the impact of such flaw it is possible to query the Shodan search engine, a number of devices between 500,000 and 700,000 could be affected.
CVE-2017-17562: Remote LD_PRELOAD exploitation of GoAhead web server.
So this runs a hell of a lot of things: printers, network gear, CC cameras. Users of telecoms hosting stuff. Convenience without proper configuration.What I found on Shodan now: pic.twitter.com/TZW4QyixMk
— 3ncr1pt3d (@3ncr1pt3d) December 19, 2017
Elttam also released a proof-of-concept code that could be used to test if IoT devices are vulnerable to the CVE-2017-17562 flaw.
Such kind of flaws are exploited by IoT malware like BrickerBot, Mirai, Hajime, and Persirai.
In March, the researcher Pierre Kim revealed that more than 185,000 vulnerable Wi-Fi-connected cameras are exposed to the Internet, due to a flaw in GoAhead server.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/67113/iot/goahead-flaws.html