CVE-2017-17562

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Embedthis GoAhead versions before 3.6.5 contain a remote code execution vulnerability that manifests when CGI support is enabled and CGI programs are dynamically linked. The root cause is in the cgiHandler function in cgi.c, which populates the environment of forked CGI scripts from untrusted HTTP request parameters without sanitization. When the target process uses the glibc dynamic linker, specially named parameters such as LD_PRELOAD can be supplied to load attacker-controlled code.

An unauthenticated remote attacker can exploit the flaw over the network by sending an HTTP request that includes a malicious shared-object payload in the POST body and references that payload via /proc/self/fd/0 in the crafted environment variable. Successful exploitation grants arbitrary code execution with the privileges of the CGI process, corresponding to a CVSS 3.1 base score of 8.1.

Public references point to an upstream commit that addresses the issue and to Oracle’s April 2018 Critical Patch Update, which includes remediation guidance for affected Oracle products that embed GoAhead. The project issue tracker and security advisory repositories further recommend upgrading to version 3.6.5 or later and disabling CGI when it is not required.