CVE-2017-17562
HIGH KEV NUCLEIEmbedthis GoAhead <3.6.5 - Remote Code Execution
Title source: nucleiExploitation Summary
CVE-2017-17562 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 10, 2021.
EIP tracks 9 public exploits from researchers including Metasploit, Daniel Hodson, ivanitlearning, including a Metasploit module exploits/linux/http/goahead_ldpreload.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2017-17562, a vulnerability in GoAhead web server that allows arbitrary shared library loading via LD_PRELOAD. It supports multiple architectures and payload types, including reverse and bind shells.
Description
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
Exploits (9)
This Metasploit module exploits CVE-2017-17562, a vulnerability in GoAhead web server that allows arbitrary shared library loading via LD_PRELOAD. It supports multiple architectures and payload types, including reverse and bind shells.
This exploit targets CVE-2017-17562, a remote code execution vulnerability in GoAhead httpd versions 2.5 to 3.6.5. It leverages LD_PRELOAD environment variable injection via CGI scripts to execute arbitrary shared objects.
This is a Python 3 exploit for CVE-2017-17562, targeting GoAhead web server versions 2.5 to 3.6.5. It automates the discovery of vulnerable CGI endpoints and delivers a malicious ELF shared object payload via LD_PRELOAD injection to achieve remote code execution.
This is a functional exploit for CVE-2017-17562, targeting GoAhead Web Server versions < 3.6.5. It leverages the LD_PRELOAD environment variable injection via CGI scripts to achieve remote code execution by sending a malicious shared object payload.
This repository provides a Bash-based PoC for CVE-2017-17562, a vulnerability in GoAhead web server. It uses curl to craft HTTP requests and requires a crafted payload for exploitation.
This is a functional exploit for CVE-2017-17562, targeting GoAhead httpd versions 2.5 to 3.6.5. It leverages the LD_PRELOAD environment variable injection vulnerability to achieve remote code execution by sending a malicious shared object payload via a crafted POST request to a CGI script.
This repository contains a reverse shell PoC for CVE-2017-17562, targeting the Goahead web server. The exploit leverages a constructor function to establish a reverse shell connection to a remote address and port, executing /bin/bash upon connection.
This repository provides a Bash-based PoC for CVE-2017-17562, a vulnerability in GoAhead web server. It crafts HTTP requests using curl to exploit the vulnerability and requires a crafted payload to achieve remote code execution.
This Metasploit module exploits CVE-2017-17562 in GoAhead web server by leveraging the LD_PRELOAD vulnerability to load arbitrary shared libraries via CGI scripts. It supports multiple architectures and payload types, including reverse and bind shells.
Nuclei Templates (1)
cpe:"cpe:2.3:a:embedthis:goahead"
References (9)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H