In the http server (nhttpd) vulnerability
(CVE-2019-16278), allowing an attacker to remotely execute their code on the server by sending a specially crafted HTTP request. The issue will be resolved in the release (not yet published). According to information from the Shodan search engine, the Nostromo http server is used on approximately 2000 publicly accessible hosts.
The vulnerability is caused by an error in the http_verify function, which allows access to the file system contents outside the root directory of the site by passing the sequence «..\/» in the path. The vulnerability occurs because the check for the presence of the characters «..\/» is performed before the path normalization function is executed, which removes newline characters () from the string.
For The vulnerability allows access to \/bin\/sh instead of a CGI script and the execution of any shell command by sending a POST request to the URI «\/..\/..\/..\/..\/bin\/sh» and passing commands in the body of the request. Interestingly, a similar vulnerability (CVE-2011-0751) was already fixed in Nostromo in 2011, which allowed attacks through sending the request «\../....bin\/sh».
Source: opennet.ru
