CVE-2017-17562

KEVEmbedthis GoAhead Remote Code Execution Vulnerability

Description

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedDec 12, 2017

Last modifiedJun 17, 2026

Added to KEVDec 10, 2021

Remediation dueJun 10, 2022

References

oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatchThird Party Advisory
securitytracker.com/id/1040702Broken LinkThird Party Advisory
github.com/elttam/advisories/tree/master/CVE-2017-17562Broken LinkThird Party Advisory
github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74Broken LinkPatch
github.com/embedthis/goahead/issues/249Broken LinkIssue Tracking
elttam.com.au/blog/goahead/Broken LinkExploit
exploit-db.com/exploits/43360/ExploitThird Party Advisory
exploit-db.com/exploits/43877/ExploitThird Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-17562US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1599 days
CVSS: 8.1 HIGH
EPSS (30-day exploit probability): 97.1% · top 1% of all CVEs
Weakness: NVD-CWE-noinfo
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.