Nostromo 1.9.6 - Remote Code Execution

An unauthenticated attacker can force server points to a shell file like ‘/bin/sh’ and execute arbitrary commands due to the failure in verifying the URL which leads to path traversal to any file that exists in the system. Nostromo’s versions such as 1.9.6 fail to verify this URL and the developer’s website (www.nazgul.ch), was also vulnerable.

Impact

A successful attack will result in gaining sensitive details such as application code and data, operating system files, etc.

Mitigation / Precaution

• We recommend you to apply the patch released on the developer’s official website (http://nazgul.ch/dev_nostromo.html).

Written by

Nash N Sulthan

Cyber Security Lead Engineer

Nash is a seasoned Security Engineer who brings a multifaceted approach to safeguarding digital environments. Not only does he excel in implementing robust security measures, but he's also deeply involved in the research and development process, constantly innovating to stay ahead of cyber threats. Nash's commitment to security extends beyond the conventional, making him a valuable contributor to the evolving landscape of digital defense.