Wiz Details Nuclei Signature-Verification Bypass That Could Enable Malicious Template Execution
Summary
Wiz disclosed CVE-2024-43405, a Nuclei signature-verification bypass caused by mismatched Go regex and YAML newline handling. Crafted templates could execute unverified code; Nuclei 3.3.2 fixes it.
Key points
- The bypass stems from Go’s regex-based signature handling and the YAML parser interpreting carriage returns differently.
- Nuclei verifies the first digest line but removes all digest lines from the content used for signature verification, creating an opportunity to inject unverified template content.
- A crafted template could cause unverified code to execute when parsed, potentially enabling command execution, data exfiltration, or system compromise.
- The risk applies when organizations run untrusted or community-contributed templates, or let users upload or modify templates in scanning services or shared pipelines.
- Wiz reported the vulnerability to ProjectDiscovery on August 14, 2024; a fix was committed August 19 and released September 4.
- Wiz recommends upgrading to Nuclei 3.3.2 or later and running Nuclei in an isolated environment.
Article Details
- Attack Vectors
- A crafted Nuclei template can use carriage-return line breaks and additional digest lines to bypass signature verification while injecting content that the YAML parser executes.
- Running untrusted or community-contributed templates, or allowing users to upload or modify templates in scanning platforms or shared security pipelines, can expose the host to malicious template execution.
- The article's illustrative malicious template uses Nuclei's code protocol to run shell commands, read /etc/shadow, and send data to a remote server.
- Defensive Notes
- Upgrade Nuclei to version 3.3.2 or later.
- Run Nuclei in an isolated or sandboxed environment, especially when executing untrusted or community-contributed templates.
- Strictly validate template sources.
MITRE ATT&CK
T1003.008 · /etc/passwd and /etc/shadowThe illustrative template reads /etc/shadow from the host running Nuclei.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolThe illustrative template sends the contents of /etc/shadow to a remote server using an HTTP POST via curl.T1059.004 · Unix ShellThe illustrative malicious Nuclei template uses the code protocol to execute commands with sh or bash.