Remote code execution in GoAhead - CVE-2017-17562

Vulnerability identifier: #VU9817

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-17562

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error in the cgiHandler function when CGI is enabled and a CGI program is dynamically linked. A remote attacker can make untrusted HTTP request parameters containing shared object payload in the cgiHandler function in cgi.c, allocate an array of pointers for the envp argument of the new process, initialize the environment of forked CGI scripts and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

GoAhead
Integrated Lights Out Manager
TD220MAX
TD220X
iNET II
iNET

Update to version 3.6.5.

TD220MAX - update to 1.2.6
TD220X - update to 2.0.16
iNET II - update to 8.3.0
iNET - update to 8.3.0

• Exploit #8866 - goahead-rce-exploit (Exploit for CVE-2017-17562 vulnerability, that allows RCE on GoAhead (< v3.6.5) if the CGI is enabled and a CGI program is dynamically linked.) (February 23, 2023)
• Exploit #6330 - GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Remote Code Execution (June 17, 2021)
• Exploit #6331 - GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Arbitrary Module Load (Metasploit) (June 17, 2021)
• Exploit #2050 - CVE-2017-17562 (Standalone Python 3 exploit for CVE-2017-17562) (March 18, 2020)
• Exploit #1833 - GoAhead Web Server LD_PRELOAD Arbitrary Module Load (March 18, 2020)

• https://www.elttam.com.au/blog/goahead/

• Remote code execution in Elttam GoAhead
• Multiple vulnerabilities in Oracle Sun Systems Products
• Remote code execution in General Electric Renewable Energy MDS Radios