Goahead Versions <= 6.0.0 Vulnerable to Use After Free and Double Free Vulnerabilities

CVE-2024-3187

Summary

This vulnerability involves two specific issues classified as Use After Free (UAF) and one Double Free vulnerability within the Goahead web server framework. These vulnerabilities stem from Javascript template (JST) values not being cleared when they are freed during the parsing of JST templates. If the ME_GOAHEAD_JAVASCRIPT flag is activated, an attacker with the ability to modify JST files could exploit this flaw by uploading malicious templates. This can lead to memory corruption, resulting in potential Denial of Service conditions, with the possibility of code execution under particular circumstances.

References