Vulnerability Affects Hundreds of Thousands of IoT Devices (server vulnerable to remote code executi

[LASER_oneXM]

Here's something to be cheery on Christmas Day —a vulnerability affecting a web server that's been embedded in hundreds of thousands of IoT devices.

The said vulnerability affects GoAhead, a tiny web server package created by Embedthis Software LLC, a company based in Seattle, USA.

On GoAhead's homepage, Embedthis claims its product is currently deployed inside products released by big industry names such as Comcast, Oracle, D-Link, ZTE, HP, Siemens, Canon, and many others.

This tiny web server is quite popular with hardware vendors since it can run on devices with limited resources, such as Internet of Things (IoY) devices, routers, printers, and other networking equipment

GoAhead server vulnerable to remote code execution

This week, security researchers from Australian company Elttam discovered a way execute malicious code remotely on devices using the GoAhead web server package.

The technical details of this vulnerability, which is tracked as CVE-2017-17562, are explained in a technical write-up here.

Attackers can exploit this flaw if CGI is enabled and a CGI program is dynamically linked, which is quite a common configuration options.

Between 500K and 700K devices presumably affected

Elttam reported the flaw to Embedthis, and the server released a patch. All GoAhead versions before GoAhead 3.6.5 are presumed vulnerable, albeit researchers only verified the flaw on GoAhead versions going back to version 2.5.0 only.


Embedthis has done its part. Now, what's left is for all hardware vendors to incorporate the GoAhead patch into a firmware update for all the affected devices.

Flaw expected to cause big problems, again

This vulnerability in a tiny software component is expected to cause big issues going forward.

This isn't the first vulnerability found in GoAhead. In March, security researchers Pierre Kim and Istvan Toth independently found different GoAhead flaws, while Cybereason also found other GoAhead flaws way back in 2014.

IoT malware like Mirai, Hajime, BrickerBot, Persirai, and others, were seen exploiting GoAhead flaws in the past year. Unfortunately, past events tell us that IoT malware authors will jump on this bug and start exploiting it in attacks, if they haven't already. With such a large pool of devices available online, this is almost a certainty.