CVE-2019-16064
📋 TL;DR
CVE-2019-16064 is a directory traversal vulnerability in NETSAS Enigma NMS that allows authenticated attackers to access files outside the web root. This enables reading, modifying, and deleting files on the server. All users running version 65.0.0 or earlier are affected.
💻 Affected Systems
- NETSAS Enigma NMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary file upload leading to remote code execution, credential theft, or data destruction.
Likely Case
Unauthorized access to sensitive configuration files, application data, and system information leading to data breach or service disruption.
If Mitigated
Limited impact with proper file permissions, web server sandboxing, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires valid credentials but uses simple path traversal techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 65.0.0
Vendor Advisory: https://www.mogozobo.com/?p=3647
Restart Required: Yes
Instructions:
1. Upgrade to the latest version of NETSAS Enigma NMS. 2. Restart the application service. 3. Verify the fix by testing directory traversal attempts.
🔧 Temporary Workarounds
Web Server File Restriction
allConfigure web server to restrict access to parent directories
# Apache: Set AllowOverride None in httpd.conf
# Nginx: Use 'deny all' in location blocks for sensitive paths
Application Sandboxing
allRun web server with minimal privileges in restricted directory
# Linux: chroot jail setup
# Windows: Use AppLocker or similar restrictions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Enigma NMS from critical systems
- Deploy web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Attempt directory traversal using authenticated session: try accessing ../../etc/passwd or similar pathsCheck Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Test same directory traversal attempts after patch - should return access denied errors📡 Detection & Monitoring
Log Indicators:
- Multiple failed attempts to access ../ or ..\ patterns in web logs
- Unusual file access patterns from authenticated users
Network Indicators:
- HTTP requests containing ../ or ..\ sequences
- Unexpected file uploads to non-standard paths
SIEM Query:
web_access_logs WHERE url CONTAINS '../' OR url CONTAINS '..\' AND response_code = 200