Loading vulnerability…
CVE-2017-17562 is a remote code execution vulnerability in Embedthis GoAhead before version 3.6.5. The flaw occurs in the CGI request handling logic, specifically in the cgiHandler function in cgi.c, where environment variables for forked CGI scripts are initialized from untrusted HTTP request parameters. When CGI support is enabled and the target CGI program is dynamically linked, an attacker can supply specially crafted parameter names that are interpreted by the glibc dynamic linker as process environment variables. This allows attacker-controlled influence over dynamic loading behavior and can be abused to load arbitrary code during CGI execution, including by referencing attacker-supplied content delivered in the request body through process file descriptors.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (modules/exploits/linux/http/goahead_ldpreload.rb) that exploits CVE-2017-17562, a vulnerability in the GoAhead web server (versions 2.5 up to but not including 3.x) when the CGI module is enabled. The exploit works by sending specially crafted HTTP POST requests to CGI endpoints, attempting to leverage the LD_PRELOAD environment variable to load an attacker-controlled shared library, resulting in arbitrary code execution. The module supports a variety of payloads, including reverse shells, bind shells, and command execution, and can target multiple Linux architectures. The module automatically searches for common CGI endpoints and can be configured with a specific TARGET_URI. The attack vector is network-based, requiring access to the vulnerable web server. The code is weaponized, as it is part of the Metasploit framework and supports customizable payloads. No hardcoded IPs or domains are present, but the exploit targets HTTP CGI endpoints, typically under /cgi-bin/ or similar paths.
This repository contains a Python exploit (exploit.py) for CVE-2017-17562, a remote code execution vulnerability in GoAhead Web Server versions prior to 3.6.5. The exploit targets servers with CGI enabled and at least one dynamically linked CGI program. The attacker must generate a malicious ELF shared object payload (e.g., with msfvenom) and provide it to the script, which then probes a list of possible CGI endpoints (from paths.lst) on the target server. If a vulnerable endpoint is found, the script uploads the payload via HTTP POST with the LD_PRELOAD environment variable set, triggering execution of the attacker's code. The README.md provides detailed usage instructions, including payload generation and listener setup. The repository structure is straightforward: exploit.py (main exploit script), paths.lst (CGI endpoint wordlist), requirements.txt (Python dependencies), and README.md (documentation). The exploit is operational and requires attacker-supplied payloads, providing remote code execution on vulnerable GoAhead servers.
This repository contains a standalone Python 3 exploit for CVE-2017-17562, targeting the GoAhead web server (versions 2.5 up to 3.6.5) on Linux. The exploit leverages a vulnerability in the server's CGI handling to achieve remote code execution via LD_PRELOAD. The attacker must supply a malicious ELF shared object payload (such as a reverse shell generated with msfvenom) and specify the target host, port, and CGI path. If the CGI path is unknown, the script can brute-force common CGI endpoints to find a vulnerable one. The exploit works by sending the payload to the CGI endpoint with a specially crafted query string, causing the server to load and execute the attacker's code. The repository consists of two files: a README.md with usage instructions and background, and exploit.py, the main exploit script. The exploit is operational, requiring the attacker to generate their own payload and providing remote code execution if successful.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability included among the exploit targets used by the Gitpaste-12/X10-unix cryptomining worm.
A GoAhead Web Server vulnerability referenced as one of multiple exploits used in mass scanning activity.
A GoAhead web server remote code execution vulnerability included in the attackers' mass scanning/exploitation attempts.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.