CVE-2024-3184 | Nozomi Networks Labs

Summary

Multiple NULL Pointer Dereference vulnerabilities were discovered in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC flag. This allows remote attackers to cause a crash and a denial of service via malicious requests.

Impact

In case the ME_GOAHEAD_REPLACE_MALLOC compilation flag is enabled and a memory notifier is not implemented to handle allocation failures, a remote unauthenticated attacker may send malicious requests to trigger a crash and cause a Denial of Service (DoS) condition over the service.

Issue Date

October 14, 2024

Affects

GoAhead <= 6.0.0

CVE Name

CVE-2024-3184

CVSS Details

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS Score

5.9

Solution

It is recommended to apply fixes introduced in version 6.0.1 of GoAhead and use the latest version available as base for building custom web servers.

Mitigations

Acknowledgements

Diego Zaffaroni of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more