CVE-2019-16278 – CVE-2019-16278 is a directory traversal vulnera... (How to Fix)

📋 TL;DR

CVE-2019-16278 is a directory traversal vulnerability in nostromo nhttpd web server that allows attackers to escape the document root and execute arbitrary commands via crafted HTTP requests. This enables remote code execution with the privileges of the web server process. All systems running nostromo nhttpd version 1.9.6 and earlier are affected.

💻 Affected Systems

Products:

nostromo nhttpd

Versions: Through 1.9.6

Operating Systems: Linux, BSD, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: All default installations are vulnerable. The vulnerability exists in the http_verify function regardless of configuration.

📦 What is this software?

Nostromo Nhttpd by Nazgul

View all CVEs affecting Nostromo Nhttpd →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with root privileges if nhttpd runs as root, leading to complete data loss, lateral movement, and persistent backdoor installation.

🟠

Likely Case

Remote code execution with web server user privileges, allowing file system access, data exfiltration, and further exploitation of the host.

🟢

If Mitigated

Limited impact if proper network segmentation, least privilege, and monitoring are in place, though initial compromise still possible.

🌐 Internet-Facing: HIGH - Directly exploitable via HTTP requests without authentication, making internet-facing instances immediate targets.

🏢 Internal Only: MEDIUM - Still exploitable from internal networks, but requires initial network access.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploits available with simple HTTP requests. Exploitation requires no authentication and is trivial to execute.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.9.7 or later

Vendor Advisory: http://www.nazgul.ch/dev/nostromo_cl.txt

Restart Required: Yes

Instructions:

1. Download latest version from http://www.nazgul.ch/dev/nostromo-1.9.7.tar.gz
2. Stop nhttpd service
3. Backup configuration files
4. Install new version
5. Restart nhttpd service

🔧 Temporary Workarounds

Network Access Control

linux

Block external access to nostromo nhttpd ports (default 8080)

iptables -A INPUT -p tcp --dport 8080 -j DROP

Service Disablement

linux

Temporarily disable nostromo nhttpd service until patched

systemctl stop nostromo
systemctl disable nostromo

🧯 If You Can't Patch

Implement strict network segmentation to isolate nostromo servers
Deploy web application firewall (WAF) rules to block directory traversal patterns

🔍 How to Verify

Check if Vulnerable:

Check if nostromo version is 1.9.6 or earlier: 'nostromo -v' or examine running process

Check Version:

nostromo -v 2>&1 | head -1

Verify Fix Applied:

Confirm version is 1.9.7 or later: 'nostromo -v' and test with known exploit payloads

📡 Detection & Monitoring

Log Indicators:

HTTP requests containing '../' patterns
Unusual process execution from nhttpd user
Failed directory traversal attempts in access logs

Network Indicators:

HTTP requests with encoded directory traversal sequences
Unusual outbound connections from nhttpd process

SIEM Query:

source="nostromo.log" AND "../" OR "%2e%2e%2f"

📊 Metadata

CVE ID: CVE-2019-16278

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-22

Published: October 14, 2019

Last Updated: November 6, 2025

🔗 References

http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://www.nazgul.ch/dev/nostromo_cl.txt Release Notes
https://git.sp0re.sh/sp0re/Nhttpd-exploits Broken Link,Exploit,Third Party Advisory
https://sp0re.sh Broken Link,Not Applicable
http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://www.nazgul.ch/dev/nostromo_cl.txt Release Notes
https://git.sp0re.sh/sp0re/Nhttpd-exploits Broken Link,Exploit,Third Party Advisory
https://sp0re.sh Broken Link,Not Applicable
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16278 US Government Resource

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2019-16278, you might also want to check these: