Later archive addition

Remote LD_PRELOAD Exploitation

Daniel Hodson

GoAhead's cgiHandler copies every HTTP request parameter into the forked CGI process's environment, filtering only REMOTE_HOST and HTTP_AUTHORIZATION, so a query string can set LD_PRELOAD. launchCgi dup2s the POST body's temporary file onto stdin, so LD_PRELOAD=/proc/self/fd/0 makes the linker load the posted shared object, whose constructor runs before main - unauthenticated remote code execution in GoAhead below 3.6.5 (CVE-2017-17562).

Record

Researcher

Daniel Hodson

In the archive

• Added to the 2016–17 archive after the original list was published

Related sources

• Advisory and exploit

Tags

• rce
• cve
• embedded-device
• case-study

This page is the archive's own catalogue record. The research is the work of Daniel Hodson, first published at the original source. Preserved copies are kept so the citation survives its host.