🔙 목록으로 돌아가기

CVE-2017-17562: Embedthis GoAhead <3.6.5 - Remote Code Execution

Title	Embedthis GoAhead <3.6.5 - Remote Code Execution
Author	geeknik
Severity	High
Impact	Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system.
Remediation	Upgrade to Embedthis GoAhead version 3.6.5 or later to mitigate this vulnerability.
CVSS Score	8.1
EPSS Score	0.9403
CVE ID	CVE-2017-17562
CWE ID	CWE-20
Shodan Query	cpe:"cpe:2.3:a:embedthis:goahead"
Tags	cve cve2017 rce goahead kev vulhub embedthis vkev vuln

🔍 Vulnerability Description

description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.

🌐 HTTP Request

GET /cgi-bin/admin?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.4 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/checkCookie?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/htmlmgr?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/chn/liveView?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/getCheckCode?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/apply?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/check_user?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Mobile/15E148 Safari/604.1
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/get_status?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.12
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/cnswebserver?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/configure/set_link_neg?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/config?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.10
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/getmac?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/non-CA-rev?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/cht/liveView?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.4.24
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/getparam?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/index/login?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/cgitest?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/guest/Login?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/jscript?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/eng/liveView?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/home?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; arm64 Mac OS X 12_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/kvm?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/index?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/firmware?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/configure/swports_adjust?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/liveView?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/login?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/login.asp?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.1.2 Safari/603.3.8
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/login/login?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/login/login-page?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/login_mgr?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/luci?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/main?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/main-cgi?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/manage/login?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/menu?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Mobile/15E148 Safari/604.1
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/mlogin?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/netbinary?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/nobody/Captcha?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/nobody/VerifyCode?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/normal_userLogin?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/otgw?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/page?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/rulectl?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Safari
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/service?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/set_new_config?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/sl_webviewer?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/ssi?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/status?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/sysconf?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/systemutil?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Mobile/15E148 Safari/604.1
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/t/out?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/top?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/unauth?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.107 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/upload?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/variable?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/wanstatu?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/webcm?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/webmain?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/webproc?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/webscr?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/webviewLogin?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/webviewLogin_m64?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.6
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/webviewer?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1
Accept: */*
Accept-Encoding: gzip
Connection: close

GET /cgi-bin/welcome?LD_DEBUG=help HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0
Accept: */*
Accept-Encoding: gzip
Connection: close

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17562.yaml

🦈 Packet Capture: ⬇️ Download cve-2017-17562.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A