This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A critical **Path Traversal** flaw in `nostromo nhttpd`'s `http_verify` function.β¦
π‘οΈ **Root Cause**: **CWE-22** (Improper Limitation of a Pathname to a Restricted Directory). The server fails to properly filter special characters (like `../` and `%0d`) in resource/file paths. π§
Q3Who is affected? (Versions/Components)
π¦ **Affected**: **nostromo nhttpd** versions **1.9.6 and earlier**. π These are lightweight, open-source web servers often found in embedded systems or legacy setups. β οΈ
Q4What can hackers do? (Privileges/Data)
π£ **Attacker Capabilities**: Unauthenticated **Remote Code Execution (RCE)**. Hackers can run arbitrary system commands (e.g., `id`, `ls`, `pwd`) with the privileges of the web server process. π
Q5Is exploitation threshold high? (Auth/Config)
π **Threshold**: **LOW**. No authentication is required. The vulnerability is triggered via specific HTTP POST requests with crafted headers. Any public-facing instance is at risk. π―
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exploits**: **YES**. Multiple PoCs and automated scripts are available on GitHub (e.g., `jas502n`, `ianxtianxt`). Wild exploitation is highly likely due to ease of use. π
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for **nostromo** server banners. Test for path traversal using payloads like `POST /.%0d./.%0d./bin/sh`. Check if the server responds to directory traversal attempts. π΅οΈββοΈ
Q8Is it fixed officially? (Patch/Mitigation)
π οΈ **Fix**: Upgrade to **nostromo nhttpd version > 1.9.6**. The vendor released patches addressing the input validation flaw in the `http_verify` function. β
Q9What if no patch? (Workaround)
π§ **No Patch?**: **Mitigation**: Restrict access via **WAF** or **Firewall** rules. Block suspicious HTTP methods or paths containing `../` and `%0d`. Isolate the server from the public internet. π
Q10Is it urgent? (Priority Suggestion)
π **Urgency**: **CRITICAL**. CVSS score is high due to RCE impact and low exploitation complexity. Immediate patching or mitigation is required to prevent server takeover. β³