CISA KEV · Known exploitedHigh

CVE-2017-17562

Embedthis GoAhead

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

CVSS: 8.1
EPSS: 96.3%
CISA KEV: Listed
Published: 2017.12.13

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability96.3%

Technical severityCVSS 8.1

Vulnerability overview

Affected product and versions

Product: Embedthis GoAhead
Affected versions: < 3.6.5, 3.0, 4.0
Fixed versions: 3.6.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.06.10

1
Identify
Confirm that Embedthis GoAhead and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-20
KEV added: 2021.12.10
Ransomware use: 미확인