CVE-2017-17562

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

96.33% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-12-10

Nuclei

high · CWE-20

Published

2017-12-12

Updated

2025-10-21

Proof-of-concept exploits (9)

• https://www.elttam.com.au/blog/goahead/
• 1337g/CVE-2017-175621★ · 2017-12-27
• crispy-peppers/Goahead-CVE-2017-175620★ · 2019-11-23
• cyberharsh/GoAhead-cve---2017--175620★ · 2020-08-12
• freitzzz/bash-CVE-2017-175621★ · 2021-11-17
• fssecur3/goahead-rce-exploit8★ · 2023-09-19
• ivanitlearning/CVE-2017-1756210★ · 2019-11-02
• joaomagfreitas/bash-CVE-2017-175621★ · 2021-11-17
• nu11pointer/goahead-rce-exploit8★ · 2023-09-19

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17562.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/goahead_ldpreload.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/43877
• https://www.exploit-db.com/exploits/43360

Vulhub environments (1)

• vulhub/vulhub/tree/master/goahead/CVE-2017-17562

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2017/CVE-2017-17562.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2017-10271
• CVE-2017-12149
• CVE-2017-12615
• CVE-2017-17215
• CVE-2017-3881
• CVE-2018-0101