U.S. CISA adds Palo Alto Expedition, Android, CyberPanel and Nostromo nhttpd bugs to its Known Exploited Vulnerabilities catalog

Nostromo nhttpd, a lightweight open-source HTTP server for Unix systems, is vulnerable to a directory traversal flaw (CWE-22) in its http_verify function, affecting every release through version 1.9.6. An unauthenticated remote attacker triggers it with a crafted HTTP request whose URL contains traversal sequences that http_verify fails to normalize, letting the request escape the server's webroot and reach system paths. Via that escaped path, combined with the server's request handling, the attacker achieves remote code execution with the privileges of the nhttpd process, giving a full confidentiality/integrity/availability impact (CVSS 3.1: 9.8, network vector, no privileges or user interaction required). Anyone running nostromo nhttpd 1.9.6 or earlier is affected, with internet-exposed instances at greatest risk; deployments are typically individual Unix hosts rather than large managed fleets. Exploitation is active: public proof-of-concept exploits have existed since 2019, EPSS assigns a 99% probability of exploitation in the next 30 days (100th percentile), and CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-11-07 (ransomware use: unknown).

Do: Upgrade nostromo nhttpd to a fixed release newer than 1.9.6 (the fix shipped in 1.9.7) or install your distribution's patched package; if patching is not possible, CISA's required action is to apply vendor mitigations or discontinue use of the product. Inventory internet-facing hosts for the 'Server: Nostromo' banner, treat any unpatched exposed instance as at-risk given active exploitation, and review access logs for crafted traversal requests; ransomware association is currently unknown.

CVE-2024-43047 is a use-after-free vulnerability (CWE-416) in the firmware of several Qualcomm connectivity chipsets and the QAM8295P automotive SoC, where maintaining memory maps of high-level operating system (HLOS) memory causes memory corruption. The flaw is scored with a local attack vector and low privileges required (CVSS 3.1: 7.8), so an attacker needs some local foothold, such as a malicious app on an Android device, and can then leverage the memory corruption for high-impact confidentiality, integrity, and availability effects, in practice a privilege escalation to system or kernel level. Anyone running devices built on the affected chips is exposed, including Android smartphones with FastConnect 6700/6800/6900/7800, devices using QCA-series Wi-Fi chips, and automotive platforms using the QAM8295P. The vulnerability is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-08, and news reports describe targeted, limited Android attacks, though ransomware use is unknown and EPSS remains modest at 0.7%.

Do: Apply Qualcomm's fix through your device or system OEM: install the latest Android security updates on affected phones, and update firmware/drivers for QCA-series Wi-Fi chips and the QAM8295P automotive SoC per vendor instructions; because this is a local firmware flaw, there is no user-side mitigation short of patching. Organizations under CISA KEV must remediate per the required action (apply vendor remediations or discontinue use). Prioritize an inventory of Android devices with FastConnect 6700/6800/6900/7800 and QCA6xxx/65xxx chips, noting this flaw is being used in targeted attacks rather than mass-scale campaigns.

CVE-2024-43093 is a privilege escalation flaw in the Android Framework's ExternalStorageProvider (the component behind the system document/file picker), where the shouldHideDocument function mishandles Unicode normalization, allowing crafted file paths to bypass the filter that hides sensitive directories such as app-private storage (CWE-176). It is triggered locally: an app with no additional execution privileges can exploit it with user interaction, for example when a user selects a file or location through the documents UI. A successful bypass grants unauthorized access to otherwise protected directories and can lead to local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.3, vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Any device running the Android Framework is in scope, meaning effectively the entire Android installed base, although the local access and user-interaction requirements limit practical exploitability to targeted scenarios. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-07 and Google has indicated it may be under limited, targeted exploitation; no public proof-of-concept is known, and EPSS currently rates the 30-day exploitation probability at a modest 0.7%, though the KEV listing is the authoritative in-the-wild signal.

Do: Apply Google's Android security updates immediately — the fix is included in the November 2024 Android Security Bulletin (security patch level 2024-11-01) or later — and verify the device's security patch level in Settings; OEM devices (e.g., Samsung) may receive the fix through vendor updates on a lag. Per the CISA KEV required action, treat patching as urgent or apply vendor mitigations, and as an interim measure restrict sideloaded/untrusted app installs and caution users when picking files through the document picker. Ransomware linkage is unknown, and the user-interaction requirement means exploitation is targeted rather than wormable.

CyberPanel, a web hosting control panel, contains a missing-authentication flaw (CWE-306) in the upgrademysqlstatus function in databases/views.py that allows remote, unauthenticated attackers to execute arbitrary commands. The panel's secMiddleware only enforces authentication on POST requests, so attackers can reach /dataBases/upgrademysqlstatus without credentials and inject shell metacharacters into the statusfile property, which the application passes to a shell. Successful exploitation yields arbitrary command execution on the server, effectively full control of the hosting panel and the websites it manages; versions through 2.3.6 and unpatched 2.3.7 are affected. Exploitation is active: the PSAUX group used this flaw in October 2024 to deploy ransomware on web hosting servers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-11-07. A public proof-of-concept is available and EPSS places the 30-day exploitation probability at 86.5% (100th percentile).

Do: Upgrade to a patched CyberPanel build that includes fix commit 5b08cd6 (a fully patched 2.3.7 or later release); if you cannot patch immediately, restrict access to /dataBases/upgrademysqlstatus or place the panel behind an access-control layer. Because exploitation is active and ransomware-related (PSAUX), check for compromise: review web/audit logs for unauthenticated requests to /dataBases/upgrademysqlstatus, look for unexpected processes, cron jobs, or ransomware artifacts, and per CISA apply vendor mitigations or discontinue use of the product.

CVE-2024-5910 is a missing authentication flaw (CWE-306) in Palo Alto Networks Expedition, a tool used to migrate, tune, and enrich firewall configurations. An attacker with network access to an Expedition instance can exploit the unauthenticated critical function to take over the Expedition admin account without any credentials. Once in control, the attacker can access configuration secrets, credentials, and other data imported into Expedition, and public research (horizon3.ai) shows it can be chained with other Expedition bugs for full system compromise. Any organization running Expedition — particularly instances reachable from the internet or shared networks — is affected. The flaw is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-07, carries a 91.8% EPSS exploitation probability, and is being exploited alongside related Expedition and firewall bugs (CVE-2024-9463, CVE-2024-9465).

Do: Apply the vendor's patched Expedition release per Palo Alto Networks' advisory; if the tool is no longer needed, decommission or discontinue it, as CISA permits. Until patched, restrict network access to Expedition to trusted management hosts and remove it from internet exposure. Check Expedition logs for signs of unauthorized admin access and rotate any credentials or secrets stored in the tool.