Nuclei Vulnerability Could Allow Signature Verification Bypass

Researchers have identified a critical vulnerability in the Nuclei vulnerability scanner that could potentially allow threat actors to execute malicious code on targeted systems.

A Flaw in Nuclei Led to Code Injection

The team at Wiz recently uncovered a significant security flaw in Nuclei, a widely used open-source security tool developed by ProjectDiscovery. This flaw could be exploited to inject malicious code into the system.

Nuclei is a popular tool for vulnerability scanning, leveraging YAML-based templates to detect and address security issues effectively. With over 2.1 million downloads on GitHub, it is a go-to solution for organizations seeking to identify vulnerabilities accurately.

The vulnerability in question pertains to a signature verification bypass, which could enable an attacker to insert malicious code into the target templates.

Nuclei’s signature verification process involves multiple steps, including extracting the signature using regex, hashing the content, and validating the hash with the extracted signature. However, the flaw stemmed from a conflict between regex and YAML parsing during signature verification.

“The regex-based signature parser uses a specific pattern to identify the signature line, while the YAML parser treats the same line as a comment, leading to a mismatch in the verification process.”

This discrepancy allowed malicious code to be concealed within the templates, evading detection during verification and being parsed by YAML. By inserting malicious content with specific characters, attackers could exploit this vulnerability.

The vulnerability, designated as CVE-2024-43405, carries a high severity rating with a CVSS score of 7.8.

Following the disclosure of this issue, the developers promptly released a patch with Nuclei version 3.3.2. Users are advised to update to this version or later to mitigate the risk. In cases where immediate updates are not feasible, utilizing Nuclei in isolated or sandboxed environments is recommended.

We welcome your insights and feedback in the comments section.