Vulnerabilities > CVE-2019-5096 - Use After Free vulnerability in Embedthis Goahead 3.6.5/4.1.1/5.0.1

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
embedthis
CWE-416

Summary

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.

Vulnerable Configurations

Part Description Count
Application
Embedthis
3

Common Weakness Enumeration (CWE)

Talos

idTALOS-2019-0888
last seen2019-12-07
published2019-12-02
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0888
titleEmbedThis GoAhead web server code execution vulnerability

The Hacker News

idTHN:50A8529AA2108DE31ECF8EAE1D08766A
last seen2019-12-04
modified2019-12-04
published2019-12-04
reporterThe Hacker News
sourcehttps://thehackernews.com/2019/12/goahead-web-server-hacking.html
titleCritical Flaw in GoAhead Web Server Could Affect Wide Range of IoT Devices