HTTP serveris (nhttpd) haavatavus
(CVE-2019-16278), mis võimaldab ründajal kaugelt serverisse oma koodi käivitada, saates sobivalt vormindatud HTTP-päringu. Probleem lahendatakse versioonis (veel avaldamata). Otsingumootori Shodan teabe järgi kasutatakse Nostromo HTTP serverit umbes 2000 avalikult juurdepääsetaval hostil.
Vulnerability is caused by a flaw in the http_verify function that allows bypassing access to the file system content outside the root directory of the site by passing the sequence «..\/» in the path. The vulnerability manifests itself because the check for the presence of the «..\/» characters is performed before executing the path normalization function, which removes newline characters () from the string.
Kuna Through vulnerabilities, it is possible to access \/bin\/sh instead of the CGI script and execute any shell construction by sending a POST request to the URI «\/..\/..\/..\/..\/bin\/sh» and passing commands in the body of the request. Interestingly, a similar vulnerability was already fixed in 2011 in Nostromo (CVE-2011-0751), which allowed attacks through sending the request «\......bin\/sh».
Allikas: opennet.ru
