CVE-2018-16133

published 2018-08-29

CVE-2018-16133: Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.

Priority P3 52 medium 5.3 CVSS 3.0

AV N AC L PR N UI N S U C L I N A N

EXPLOIT

Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
cybrotech	cybrohttpserver	—	—

Detection & IOCs extracted from sources · hover to see the quote

path \..\..\..\..\Windows\win.ini↗

url https://\..\..\..\..\Windows\win.ini↗

• → Detect directory traversal attempts targeting CyBroHttpServer by matching HTTP GET requests containing backslash-dot-dot sequences (\..\) in the URI path. ↗
• → Confirm successful exploitation by checking HTTP response body for Windows win.ini landmark strings: 'bit app support', 'fonts', and 'extensions' all present together. ↗
• → The vulnerability is exploitable without authentication (PR:N, UI:N) over the network; monitor CyBroHttpServer (default port 8080) for traversal-pattern URIs. ↗

• · The PoC was tested on Windows only; the traversal payload uses Windows-style backslashes and targets win.ini, so detection rules relying on forward-slash traversal patterns will miss this attack. ↗
• · The Nuclei template requires 'unsafe: true' mode because the raw backslash-based URI is not standards-compliant HTTP; standard HTTP proxies or WAFs may normalize or block the request before it reaches the server. ↗

CVSS provenance

nvd v3.0 5.3 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22