Collected research
Remote LD_PRELOAD Exploitation
GoAhead's cgiHandler copies every HTTP request parameter into the forked CGI process's environment, filtering only REMOTE_HOST and HTTP_AUTHORIZATION, so a query string can set LD_PRELOAD. launchCgi dup2s the POST body's temporary file onto stdin, so LD_PRELOAD=/proc/self/fd/0 makes the linker load the posted shared object, whose constructor runs before main - unauthenticated remote code execution in GoAhead below 3.6.5 (CVE-2017-17562).
Record
- Researcher
- Daniel Hodson
- Published by
- elttam.com
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Daniel Hodson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .