Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-06-10. Apply updates per vendor instructions.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
@IntCyberDigest GoAhead is the same server behind CVE-2017-17562, and botnets were still poking at that one years later. Embedded web servers basically never get updated, so I wouldn't hold my breath on this revoked cert fix reaching most of those boxes.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | embedthis | goahead | - | - | - |
| App | oracle | integrated_lights_out_manager | 3.0 | - | - |
| App | oracle | integrated_lights_out_manager | 4.0 | - | - |