Talos experts found a critical RCE in GoAhead Web Server

guest · Dec 4, 2019

Talos experts found a critical RCE in GoAhead Web Server
December 4, 2019
https://securityaffairs.co/wordpress/94692/hacking/goahead-rce.html

GoAhead is the world’s most popular, tiny embedded web server.
It is developed by EmbedThis that defines it as compact, secure and simple to use. GoAhead is deployed in hundreds of millions of devices and is ideal for the smallest of embedded devices. Searching for GoAhead installs exposed online with Shodan search engine, at the time of writing there are over 1.3 million installs.

The first vulnerability, tracked as CVE-2019-5096, is related to how multi-part/form-data requests are processed. The flaw could be exploited by an unauthenticated attacker to trigger a use-after-free condition and execute arbitrary code on the server by sending specially crafted HTTP requests.
The security flaw has been assigned a CVSS score of 9.8.

The second vulnerability in the GoAhead web server found by Talos, tracked as CVE-2019-5097, can be exploited by an unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted HTTP requests.
According to Talos, GoAhead versions 5.0.1, 4.1.1 and 3.6.5 are affected by the two vulnerabilities. Talos reported the flaws to EmbedThis in August, and the vendor addressed them on November 21
Click to expand...

Cisco Talos: Vulnerability Spotlight: Two vulnerabilities in EmbedThis GoAhead

Log in or Sign up

Talos experts found a critical RCE in GoAhead Web Server

guest Guest

Log in or Sign up

Talos experts found a critical RCE in GoAhead Web Server

guest Guest

Useful Searches