Critical Flaw in GoAhead Web Server Could Affect Wide Range of IoT Devices

Cybersecurity researchers today uncovered details of two new vulnerabilities in the GoAhead web server software, a tiny application widely embedded in hundreds of millions of Internet-connected smart devices.

One of the two vulnerabilities, assigned as CVE-2019-5096, is a critical code execution flaw that can be exploited by attackers to execute malicious code on vulnerable devices and take control over them.

The first vulnerability resides in the way multi-part/form-data requests are processed within the base GoAhead web server application, affecting GoAhead Web Server versions v5.0.1, v.4.1.1, and v3.6.5.

According to the researchers at Cisco Talos, while processing a specially crafted HTTP request, an attacker exploiting the vulnerability can cause use-after-free condition on the server and corrupt heap structures, leading to code execution attacks.

The second vulnerability, assigned as CVE-2019-5097, also resides in the same component of the GoAhead Web Server and can be exploited in the same way, but this one leads to denial-of-service attacks.

“A specially crafted HTTP request can lead to an infinite loop in the process (resulting in 100 percent CPU utilization). The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server,” the researchers say.

However, it’s not necessary that both vulnerabilities could be exploited in all embedded devices running the vulnerable versions of the GoAhead web server.

That’s because, according to the researchers, since GoAhead is a customizable web application framework, companies implement the application according to their environment and requirements, due to which the flaws “may not be reachable on all builds.”

“Additionally, pages that require authentication do not allow access to the vulnerability without authentication as the authentication is handled before reaching the upload handler,” the researchers explain.

Talos researchers reported the two vulnerabilities to EmbedThis, the developer of the GoAhead Web Server application, in late August this year, and the vendor addressed the issues and released security patches two weeks ago.