PT-2018-1371 · Nikto · Nikto

Adam Greenhill · Published 2018-06-01 · Updated 2020-08-24 · CVE-2018-11652

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nikto versions 2.1.6 and earlier

Description The issue is related to a lack of neutralization of special elements in OS command inputs when generating a CSV file with scan results. It allows a remote attacker to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report. This can enable the attacker to execute arbitrary code using a specially crafted HTTP server.

Recommendations For Nikto versions 2.1.6 and earlier, consider disabling the CSV report generation feature until a patch is available to prevent exploitation. Restrict access to the Server field in HTTP response headers to minimize the risk of arbitrary OS command injection. Avoid using the CSV report feature with untrusted HTTP servers until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-1236

CWE-78

Related Identifiers

BDU:2018-00914

CVE-2018-11652

MGASA-2018-0310

Affected Products

Nikto

References · 16

• 🔥 https://exploit-db.com/exploits/44899 · Exploit
• https://github.com/sullo/nikto/commit/e759b3300aace5314fe3d30800c8bd83c81c29f7 · Patch
• https://osv.dev/vulnerability/CVE-2018-11652 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11652 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-11652 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0310 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00914 · Security Note
• https://ubuntu.com/security/CVE-2018-11652 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/WP2HP7GAFORSGSAPANE4VPDGGYJT5Q3B · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0310.html · Security Note
• https://cve.org/CVERecord?id=CVE-2018-11652 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-11652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11652 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-11652 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=23214 · Note