CVE-2024-3186 | Nozomi Networks Labs

Summary

NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with ME_GOAHEAD_JAVASCRIPT flag. The vulnerability can cause denial of service when processing maliciously crafted JavaScript templates.

Impact

In case the ME_GOAHEAD_JAVASCRIPT compilation flag is enabled and a malicious user is capable of controlling the content of JST templates interpreted at runtime, a remote attacker may trigger a crash and cause a Denial of Service (DoS) condition over the service.

Issue Date

October 14, 2024

Affects

GoAhead <= 6.0.0

CVE Name

CVE-2024-3186

CVSS Details

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS Score

5.3

Solution

It is recommended to apply fixes introduced in version 6.0.1 of GoAhead and use the latest version available as base for building custom web servers.

Mitigations

Acknowledgements

Diego Zaffaroni of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more