CVE-2017-17562
Embedthis GoAhead Remote Code Execution Vulnerability
- Published
- Dec 12, 2017
- Updated
- Oct 21, 2025
- Assigning CNA
- mitre
- Evidence observed
- Dec 18, 2017
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
Sources
http/cves/2017/CVE-2017-17562.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
goahead/CVE-2017-17562
GoAhead Web Server Environment Variables Injection and `LD_PRELOAD` Remote Code Execution (CVE-2017-17562)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/goahead:3.6.4(goahead/CVE-2017-17562/docker-compose.yml:services.web.image)
modules/exploits/linux/http/goahead_ldpreload.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/http/goahead_ldpreload.platform)
- verification: check_declared($.exploit_linux/http/goahead_ldpreload.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.