CVE-2019-16278
Published: 14 October 2019
Summary
CVE-2019-16278 is a critical-severity Path Traversal (CWE-22) vulnerability in Nazgul Nostromo Nhttpd. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
Nostromo nhttpd versions through 1.9.6 are affected by a directory traversal vulnerability in the http_verify function, tracked as CVE-2019-16278 and CWE-22. The issue resides in the HTTP request handling logic of this lightweight web server and enables an attacker to traverse the filesystem via malformed input.
The flaw can be exploited remotely by an unauthenticated attacker over the network using a crafted HTTP request. Successful exploitation grants arbitrary code execution with full impact on confidentiality, integrity, and availability, consistent with the CVSS 3.1 base score of 9.8.
Public exploit code demonstrating remote code execution has been published on PacketStorm and related repositories, confirming that working attacks against unpatched instances are readily available. No official vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-7077
Vulnerability details
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
- CWE(s)
- KEV Date Added
- 07 November 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the crafted HTTP request input containing directory traversal sequences before http_verify processes it.
Boundary filtering or proxy rules can inspect and drop malicious HTTP requests targeting the vulnerable nhttpd endpoint.
Running nhttpd under minimal privileges limits the scope of arbitrary code execution that the traversal enables.