Vulnerable Systems:
* nostromo (nhttpd) prior to version 1.9.4
Immune Systems:
* nostromo (nhttpd) version 1.9.4
When parsing HTTP requests, nostromo first checks for directory traversal attempts by searching for /../ in the request URI. However this check is performed before decoding escaped characters in the URI. Thus, directory traversal is possible by e.g. escaping the slashes in ../ as %2f.
Unless the chroot feature of nostromo is used, any file in the system that is readable with the runtime permissions of nostromo can be accessed.
A peculiarity of nostromo is the handling of CGI scripts. Citing the manual page, "CGIs are recognized by the file world executable flag". Therefore, any program or script, that is executable by the system user nostromo runs as, will be executed when one tries to access it through directory traversal. Any data received in the body of a HTTP POST request will be sent to standard input of executed CGI scripts.
By using directory traversal to send a HTTP POST request to /bin/sh, and providing shell commands in the request body, arbitrary command execution is possible. Similarly, interpreters of programming languages that execute program code they receive via standard input, such as perl or python, can be used to execute arbitrary program code in those languages.
Proof of Concept:
The access log of nostromo can be accessed using an URL like this:
http://www.example.org/..%2flogs/access_log
The following simple shell script implements the arbitrary command execution described above using /bin/sh:
Patch Availability:
Upgrade to development version from CVS as of 2011-03-03
Workaround:
When serving static files, the impact of this vulnerability can be reduced by using the chroot feature of nostromo. If CGI scripts are used, any interpreter required for these scripts might allow being abused as shown above.
The nostromo configuration and log files remain accessible even when using the chroot feature.
Disclosure Timeline:
2011-01-12 Problem identified during a penetration test
2011-01-31 Vendor notified
2011-03-03 Vendor releases fix
2011-03-15 Advisory released
