critical9.8Known exploitedPublic exploit code
CVE-2019-16278
Nostromo nhttpd Directory Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-11-07. Federal due date: 2024-11-28.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- nostromo 1.9.6 - Remote Code Execution2020-01-01 · remote · multiple · Verified
- Nostromo - Directory Traversal Remote Command Execution (Metasploit)2019-11-01 · remote · multiple · Verified
Impact
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nazgul | Nostromo Nhttpd | before 1.9.7 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html
- http://www.nazgul.ch/dev/nostromo_cl.txt
- https://git.sp0re.sh/sp0re/Nhttpd-exploits
- https://sp0re.sh
- http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html
- http://www.nazgul.ch/dev/nostromo_cl.txt
- https://git.sp0re.sh/sp0re/Nhttpd-exploits
- https://sp0re.sh
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16278