CVE-2019-16278
Nostromo nhttpd Directory Traversal Vulnerability
Description
CVE-2019-16278 is a critical directory traversal vulnerability in Nostromo nhttpd (also known as nostromo web server) through version 1.9.6 that enables unauthenticated remote code execution. Rated 9.8 on the CVSS v3.1 scale, this vulnerability allows an attacker to exploit the http_verify function with a crafted HTTP request to traverse directory boundaries and execute arbitrary commands on the server. With an EPSS score of 0.94393 (100th percentile) and inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2024, this remains one of the most widely exploited web server vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nazgul | nostromo nhttpd | < 1.9.7 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.nazgul.ch/dev/nostromo_cl.txt(Release Notes)
- https://git.sp0re.sh/sp0re/Nhttpd-exploits(Broken Link, Exploit, Third Party Advisory)
- https://sp0re.sh(Broken Link, Not Applicable)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16278(US Government Resource)
Weakness Type
The specific CWE classifications for CVE-2019-16278 have not been formally assigned. However, the vulnerability functionally combines two well-known weakness categories. The primary weakness is directory traversal, where the http_verify function in Nostromo nhttpd fails to properly sanitize path components in HTTP requests, allowing an attacker to navigate outside the intended web root directory. The secondary weakness is remote code execution, where the traversal capability is leveraged to access and execute system-level commands. The combination of path traversal with command execution capability transforms what might otherwise be an information disclosure issue into a complete system compromise vector.
Impact Analysis
CVE-2019-16278 carries maximum impact across confidentiality, integrity, and availability, all rated High in the CVSS assessment. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) represents the worst-case scenario for a web server vulnerability — network-accessible, low complexity, no privileges required, and no user interaction needed. Business impact is severe: an attacker can read any file on the server, modify web content, install backdoors, exfiltrate databases, and use the compromised server as a pivot point for further attacks into the internal network. The EPSS score of 0.94393 places this in the 100th percentile, meaning it has the highest predicted exploitation probability among all tracked vulnerabilities. Organizations running unpatched Nostromo web servers are essentially providing open access to their systems. While Nostromo is a lightweight HTTP server often deployed in embedded systems and IoT devices, its presence in such environments may go unnoticed during routine security audits, creating persistent blind spots in the attack surface.
Exploit Maturity
CVE-2019-16278 has mature, publicly available exploit code and is confirmed as actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2024. The ransomware association is classified as "Unknown." Multiple public exploits are available, including detailed proof-of-concept code on Packet Storm Security and a dedicated remote code execution exploit. The EPSS score of 0.94393 (100th percentile) reflects the maximum exploitation probability, driven by the combination of trivial exploitation complexity, no authentication requirements, and freely available exploit code. Automated scanning tools and exploit frameworks have incorporated this vulnerability, meaning any internet-exposed Nostromo instance is likely being targeted continuously by both opportunistic and targeted attackers.
Remediation
- Upgrade Nostromo nhttpd to version 1.9.7 or later — The official changelog documents the fix that addresses the directory traversal flaw in the http_verify function.
- Audit for Nostromo installations across your infrastructure — Search for nhttpd processes and binaries, particularly on embedded systems, IoT devices, and legacy servers that may have been overlooked in standard vulnerability management programs.
- Restrict network access to the web server — If Nostromo must remain in service during the patching window, implement firewall rules to limit access to trusted IP addresses only, and place the server behind a reverse proxy or web application firewall (WAF) capable of blocking directory traversal patterns.
- Monitor for indicators of compromise — Review web server logs for HTTP requests containing encoded directory traversal sequences (such as %0d or path components like /../), and check for unauthorized files, processes, or network connections on the server.
- Consider replacing Nostromo with a maintained alternative — Given Nostromo's limited maintenance activity, evaluate migrating to a more actively maintained and hardened web server such as nginx or Apache for production workloads.
Technical Details
The CVSS v3.1 vector for CVE-2019-16278 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a near-maximum base score of 9.8 (Critical). Attack Vector (Network) confirms the vulnerability is remotely exploitable over HTTP. Attack Complexity (Low) means the exploit is reliable and requires no special conditions. Privileges Required (None) and User Interaction (None) confirm that the attack is fully unauthenticated and automated. Scope (Unchanged) indicates the impact remains within the web server's security context, though since the server typically runs with significant system privileges, this still enables broad compromise. Confidentiality, Integrity, and Availability (all High) reflect complete system compromise potential. The attack mechanism targets the http_verify function in Nostromo nhttpd, which is responsible for validating and sanitizing HTTP request paths. By crafting an HTTP request with encoded directory traversal sequences, an attacker bypasses the path validation logic and accesses files and directories outside the web root. The traversal capability is then chained with the server's CGI handling or internal command execution mechanisms to achieve arbitrary command execution with the permissions of the nhttpd process.
Frequently Asked Questions
What is CVE-2019-16278?
CVE-2019-16278 is a critical directory traversal vulnerability in the Nostromo nhttpd web server (versions through 1.9.6) that allows unauthenticated remote code execution. An attacker can send a specially crafted HTTP request to traverse directories and execute arbitrary commands on the server.
How is CVE-2019-16278 exploited?
The vulnerability is exploited by sending crafted HTTP requests containing encoded directory traversal sequences to the Nostromo web server. Multiple public exploit tools are available, and the attack requires no authentication or user interaction, making it trivially exploitable against any exposed instance.
What systems are affected by CVE-2019-16278?
All installations of Nostromo nhttpd through version 1.9.6 are affected. Nostromo is a lightweight HTTP server sometimes found on embedded systems, IoT devices, and lightweight Linux deployments. Organizations should search for nhttpd across their entire infrastructure, including assets not covered by standard vulnerability scanners.
How do I fix CVE-2019-16278?
Upgrade Nostromo nhttpd to version 1.9.7 or later, which contains the fix for the directory traversal vulnerability. If immediate patching is not possible, restrict network access to the web server through firewall rules and deploy a WAF to block traversal patterns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.