Open source vulnerability scanner found with a serious vulnerability in its own code

Teilen:

The flaw could allow attackers to bypass Nuclei’s template signature verification process to inject malicious codes into host systems.

A widely popular open-source tool, Nuclei, used for scanning vulnerabilities and weaknesses in websites, cloud applications, and networks is found to have a high-severity flaw that could potentially allow attackers to execute malicious codes on local systems.

The flaw tracked as CVE-2024-43405 is assigned a CVSS score of 7.4 out of 10 and is said to impact all versions of Nuclei later than 3.0.0.

Attackers could use maliciously crafted templates with arbitrary codes that can allow access to sensitive host data, according to the researchers at Cloud security firm Wiz, which was credited with the discovery of CVE-2024-43405. The bypass POC has been published with the description for users.

According to a description by ProjectDiscovery, the developer and maintainer of Nuclei, the flaw is present in the template signature verification process, specifically in the “signer” package.

“A vulnerability has been identified in Nuclei’s template signature verification system that could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template,” ProjectDiscovery said in the description.

The flaw has received a patch in the Nuclei v3.3.2 rollout.

Spoofing Nuclei’s template verification

Nuclei has over 21,000 stars on GitHub and over 2.1 million downloads. The tool uses “templates,” in the form of YAML files, that define specific checks or tests for the vulnerability scanning process. Ensuring the authenticity of these templates is crucial to avoid tampered or malicious templates that are misleading or compromising the scanning process.

Nuclei has a Go regex-based signature verification process in place to ensure authenticity. The flaw stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, ProjectDiscovery explained. While Go’s verification logic considers “\r” part of the same line, the YAML parser treats it as a line break, thereby leaving room for attackers to insert malicious codes.

This, combined with the fact that Nuclei has flawed processing of multiple signature lines “digest:,” can potentially lead to an attacker injecting malicious content into a template while keeping the signature valid for the harmless portion of the template.

Both CLI and SDK users are affected

According to ProjectDiscovery, both CLI and SDK users of Nuclei are impacted and need to apply patches. CLI users include those executing custom code templates from unverified sources like third parties and unverified repositories.

SDK users are affected when developers integrating Nuclei into their platforms permit the execution of custom code templates by end-users.

Apart from upgrading to the fixed version that has been available since September 4, 2024, an interim measure could include refraining from using custom templates, ProjectDiscovery advised.

Quelle

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
10:51 am, Jan. 21, 2025
Wetter-Symbol 5°C
L: 3° | H: 5°
overcast clouds
Luftfeuchtigkeit: 91 %
Druck: 1015 mb
Wind: 3 mph WSW
Windböe: 8 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 100%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 7:53 am
Sonnenuntergang: 4:29 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 9:00 pm
Wetter-Symbol
3° | 5°°C 0 mm 0% 4 mph 91 % 1015 mb 0 mm/h
Tomorrow 9:00 pm
Wetter-Symbol
4° | 5°°C 1 mm 100% 5 mph 97 % 1009 mb 0 mm/h
Do. Jan. 23 9:00 pm
Wetter-Symbol
2° | 9°°C 1 mm 100% 17 mph 93 % 1008 mb 0 mm/h
Fr. Jan. 24 9:00 pm
Wetter-Symbol
6° | 11°°C 1 mm 100% 24 mph 90 % 1006 mb 0 mm/h
Sa. Jan. 25 9:00 pm
Wetter-Symbol
2° | 6°°C 1 mm 100% 12 mph 99 % 1013 mb 4.43 mm/h
Today 12:00 pm
Wetter-Symbol
5° | 5°°C 0 mm 0% 4 mph 91 % 1015 mb 0 mm/h
Today 3:00 pm
Wetter-Symbol
5° | 6°°C 0 mm 0% 3 mph 85 % 1014 mb 0 mm/h
Today 6:00 pm
Wetter-Symbol
4° | 4°°C 0 mm 0% 3 mph 85 % 1013 mb 0 mm/h
Today 9:00 pm
Wetter-Symbol
4° | 4°°C 0 mm 0% 3 mph 91 % 1011 mb 0 mm/h
Tomorrow 12:00 am
Wetter-Symbol
4° | 4°°C 0 mm 0% 3 mph 95 % 1009 mb 0 mm/h
Tomorrow 3:00 am
Wetter-Symbol
4° | 4°°C 0 mm 0% 3 mph 96 % 1007 mb 0 mm/h
Tomorrow 6:00 am
Wetter-Symbol
4° | 4°°C 0.84 mm 84% 3 mph 96 % 1005 mb 0 mm/h
Tomorrow 9:00 am
Wetter-Symbol
4° | 4°°C 1 mm 100% 3 mph 97 % 1004 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€99,377.99
-5.02%
Ethereum(ETH)
€3,174.96
-2.50%
XRP(XRP)
€2.98
-6.51%
Fesseln(USDT)
€0.96
0.01%
Solana(SOL)
€230.52
-9.12%
Dogecoin(DOGE)
€0.332786
-9.13%
USDC(USDC)
€0.97
0.02%
Shiba Inu(SHIB)
€0.000019
-5.78%
Pepe(PEPE)
€0.000014
-9.52%
Peanut das Eichhörnchen(PNUT)
€0.351267
-12.81%