CVE-2017-17562: Embedthis GoAhead CGI environment variable injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe vulnerability is listed in CISA KEV as known exploited, has a very high EPSS score, and allows unauthenticated remote code execution.

What it is

Embedthis GoAhead before 3.6.5 initializes the environment of forked CGI scripts using untrusted HTTP request parameters in cgiHandler in cgi.c. When CGI is enabled and the CGI program is dynamically linked, an attacker can inject special parameter names such as LD_PRELOAD to influence the glibc dynamic linker. This allows remote code execution on the affected server.

Impact

An attacker can execute arbitrary code with the privileges of the GoAhead web server process. This can lead to full compromise of the host, data theft, or use as a pivot point.

Attack surface

The flaw is reachable over the network via HTTP requests to a GoAhead server that has CGI enabled and a dynamically linked CGI program. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N).

Exploitation

CISA KEV lists this as known exploited with a due date of 2022-06-10, and EPSS shows a 30-day probability of 0.96327 (99.878th percentile). Multiple public exploit references exist, including Exploit-DB entries 43360 and 43877.

What to do

• Apply the vendor patch by upgrading Embedthis GoAhead to version 3.6.5 or later.
• Apply Oracle CPU April 2018 updates for affected Oracle Integrated Lights Out Manager (ILOM) products.
• Disable CGI functionality if it is not required for the deployment.
• Avoid dynamically linked CGI programs where possible, or restrict the environment passed to CGI processes.
• Monitor for and block HTTP requests containing suspicious parameter names such as LD_PRELOAD or LD_LIBRARY_PATH.

Detection

• Inspect HTTP request logs for parameter names matching LD_PRELOAD, LD_LIBRARY_PATH, or other dynamic linker environment variables.
• Monitor for POST requests that reference /proc/self/fd/0 in parameters or bodies.
• Detect unexpected child processes spawned by the GoAhead web server, especially those loading shared objects from unusual paths.
• Use file integrity monitoring on CGI binaries and shared libraries to detect tampering or unexpected loading.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.