Actively exploited · Published Oct 14, 2019 · Assigned by mitre
CVE-2019-16278
Critical 9.8 Exploited
In plain English
A critical-severity path traversal in nhttpd from Nostromo. Attackers are actively exploiting it in the wild (listed by CISA on November 7, 2024). The chance it is exploited in the next 30 days is estimated at 99.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Nov 28, 2024.
Official description
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.nazgul.ch/dev/nostromo_cl.txt x_refsource_MISC
- https://sp0re.sh x_refsource_MISC
- https://git.sp0re.sh/sp0re/Nhttpd-exploits x_refsource_MISC
- http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html x_refsource_MISC
- http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16278 government-resource