Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-9707.
PoCs published by Matthew Daley, including Metasploit module auxiliary/scanner/http/goahead_traversal.
AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in Embedthis GoAhead Web Server v3.4.1, allowing arbitrary file reads via crafted HTTP GET requests. It uses a traversal payload to escape the web root and fetch sensitive files like /etc/passwd.
Description
EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks, cause a denial of service (heap-based buffer overflow and crash), or possibly execute arbitrary code via a crafted URI.
Exploits (1)
This Metasploit module exploits a directory traversal vulnerability in Embedthis GoAhead Web Server v3.4.1, allowing arbitrary file reads via crafted HTTP GET requests. It uses a traversal payload to escape the web root and fetch sensitive files like /etc/passwd.