In the http server (nhttpd) vulnerability
(CVE-2019-16278), allowing an attacker to remotely execute their code on the server by sending a specially crafted HTTP request. The issue will be resolved in the release (not yet published). According to information from the Shodan search engine, the Nostromo http server is used on approximately 2000 publicly accessible hosts.
The vulnerability is caused by an error in the http_verify function, which allows access to the file system contents outside the site's root directory by passing the sequence «.. /» in the path. The vulnerability occurs because the check for the presence of the characters «.. /» is performed before executing the path normalization function, which removes line break characters () from the string.
For The vulnerabilities allow access to /bin/sh instead of the CGI script and execute any shell construct by sending a POST request to the URI «/ .. /.. /.. /.. /bin/sh» and passing commands in the request body. Interestingly, a similar vulnerability was fixed in Nostromo in 2011 (CVE-2011-0751), which allowed attacks by sending the request «/......bin/sh».
Source: opennet.ru
