The flaw could allow attackers to bypass Nuclei’s template signature verification process to inject malicious codes into host systems.
A widely popular open-source tool, Nuclei, used for scanning vulnerabilities and weaknesses in websites, cloud applications, and networks is found to have a high-severity flaw that could potentially allow attackers to execute malicious codes on local systems.
The flaw tracked as CVE-2024-43405 is assigned a CVSS score of 7.4 out of 10 and is said to impact all versions of Nuclei later than 3.0.0.
Attackers could use maliciously crafted templates with arbitrary codes that can allow access to sensitive host data, according to the researchers at Cloud security firm Wiz, which was credited with the discovery of CVE-2024-43405. The bypass POC has been published with the description for users.
According to a description by ProjectDiscovery, the developer and maintainer of Nuclei, the flaw is present in the template signature verification process, specifically in the “signer” package.
“A vulnerability has been identified in Nuclei’s template signature verification system that could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template,” ProjectDiscovery said in the description.
The flaw has received a patch in the Nuclei v3.3.2 rollout.
Spoofing Nuclei’s template verification
Nuclei has over 21,000 stars on GitHub and over 2.1 million downloads. The tool uses “templates,” in the form of YAML files, that define specific checks or tests for the vulnerability scanning process. Ensuring the authenticity of these templates is crucial to avoid tampered or malicious templates that are misleading or compromising the scanning process.
Nuclei has a Go regex-based signature verification process in place to ensure authenticity. The flaw stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, ProjectDiscovery explained. While Go’s verification logic considers “\r” part of the same line, the YAML parser treats it as a line break, thereby leaving room for attackers to insert malicious codes.
This, combined with the fact that Nuclei has flawed processing of multiple signature lines “digest:,” can potentially lead to an attacker injecting malicious content into a template while keeping the signature valid for the harmless portion of the template.
Both CLI and SDK users are affected
According to ProjectDiscovery, both CLI and SDK users of Nuclei are impacted and need to apply patches. CLI users include those executing custom code templates from unverified sources like third parties and unverified repositories.
SDK users are affected when developers integrating Nuclei into their platforms permit the execution of custom code templates by end-users.
Apart from upgrading to the fixed version that has been available since September 4, 2024, an interim measure could include refraining from using custom templates, ProjectDiscovery advised.
