Here's something to be cheery on Christmas Day —a vulnerability affecting a web server that's been embedded in hundreds of thousands of IoT devices.
The said vulnerability affects GoAhead, a tiny web server package created by Embedthis Software LLC, a company based in Seattle, USA.
On GoAhead's homepage, Embedthis claims its product is currently deployed inside products released by big industry names such as Comcast, Oracle, D-Link, ZTE, HP, Siemens, Canon, and many others.
This tiny web server is quite popular with hardware vendors since it can run on devices with limited resources, such as Internet of Things (IoT) devices, routers, printers, and other networking equipment.
This week, security researchers from Australian company Elttam discovered a way to execute malicious code remotely on devices using the GoAhead web server package.
The technical details of this vulnerability, which is tracked as CVE-2017-17562, are explained in a technical write-up here, and Elttam has released proof-of-concept code that other researchers can use to test and see if devices are vulnerable to CVE-2017-17562.
According to Elttam, the flaw is found in GoAhead's server CGI package. Attackers can exploit this flaw if CGI is enabled and if a CGI program is dynamically linked. In an email to Bleeping Computer, an Embedthis spokespersons said that "most GoAhead customers do not use CGI as GoAhead has better, faster, smaller internal alternatives," but two researchers who spoke with Bleeping Computer said that while this is true for modern devices, CGI was a common configuration option in old printers and many older models of IoT devices.
"It may be common for printers and general IOT that use other web servers that only offer CGI, but GoAhead uses in-memory alternatives that are 10-50 times faster and use less memory," the spokesperson said. "Consequently, GoAhead devices will typically not use CGI."
Elttam reported the flaw to Embedthis six months ago, and the server vendor released a patch —version 3.6.5. All server versions before GoAhead 3.6.5 are presumed vulnerable, albeit researchers only verified the flaw on GoAhead versions going back to version 2.5.0 only.
Embedthis has done its part by releasing a patch and informing other upstream equipment vendors. Now, what's left is for all hardware vendors to incorporate the GoAhead patch into a firmware update for all the affected devices. Such process is expected to take months and years, while some devices won't receive any update because they've passed their end-of-life date.
Currently, a basic Shodan search for GoAhead servers yields results that vary from 500,000 to 700,000, depending on the number of devices available online at one point or another.
Nevertheless, according to an Embedthis spokesperson, the exact number of vulnerable devices is hard to determine as Shodan will return all GoAhead products, not just the vulnerable ones. This somewhat reduces the vulnerability's severeness, as attackers will have a harder time identifying vulnerable products among modern GoAhead versions.
This vulnerability in a tiny software component is expected to cause some issues going forward. This isn't the first vulnerability found in GoAhead. In March, security researchers Pierre Kim and Istvan Toth independently found different GoAhead flaws, while Cybereason also found other GoAhead flaws way back in 2014.
IoT malware like Mirai, Hajime, BrickerBot, Persirai, and others, were seen exploiting GoAhead flaws in the past year —among with other flaws for many other vendors. Unfortunately, past events tell us that IoT malware authors will jump on this bug and start exploiting it in attacks, if they haven't already.
"Welcome to our security nightmare of convenience without proper configuration," cyber-security expert Cheryl Biswas commented on the bug earlier this week.
CVE-2017-17562: Remote LD_PRELOAD exploitation of GoAhead web server.— 3ncr1ptmas (@3ncr1pt3d) December 19, 2017
So this runs a hell of a lot of things: printers, network gear, CC cameras. Users of telecoms hosting stuff. Convenience without proper configuration.
What I found on Shodan now: pic.twitter.com/TZW4QyixMk
Article updated with comments from an Embedthis spokesperson.