CVE-2024-43405
📋 TL;DR
This vulnerability allows attackers to bypass Nuclei's template signature verification by exploiting a discrepancy in how newline characters are handled. Attackers can inject malicious code into templates while maintaining valid signatures for benign parts, potentially leading to remote code execution. CLI users executing custom code templates from unverified sources and SDK users allowing end-users to execute custom templates are affected.
💻 Affected Systems
- Nuclei
📦 What is this software?
Nuclei by Projectdiscovery
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Nuclei process, potentially leading to full system compromise, data theft, or lateral movement within networks.
Likely Case
Execution of arbitrary malicious code through specially crafted templates, potentially leading to data exfiltration, system manipulation, or further exploitation.
If Mitigated
No impact when using only verified, trusted templates from official sources with proper signature validation.
🎯 Exploit Status
Exploitation requires creating specially crafted templates that bypass signature verification. The vulnerability details are publicly disclosed in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.2
Vendor Advisory: https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-7h5p-mmpp-hgmm
Restart Required: No
Instructions:
1. Update Nuclei using: nuclei -update
2. Or download latest release from GitHub: https://github.com/projectdiscovery/nuclei/releases
3. Verify version with: nuclei -version
🔧 Temporary Workarounds
Disable custom code templates
allPrevent execution of custom code templates to block exploitation
nuclei -disable-code-templates
🧯 If You Can't Patch
- Only execute templates from trusted, verified sources with proper signatures
- Disable execution of all custom code templates in Nuclei configuration
🔍 How to Verify
Check if Vulnerable:
Check Nuclei version: nuclei -version. If version is between 3.0.0 and 3.3.1 inclusive, system is vulnerable.Check Version:
nuclei -versionVerify Fix Applied:
Run: nuclei -version. Verify version is 3.3.2 or higher. Test with known safe templates to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected template execution errors
- Signature verification failures
- Execution of templates from unverified sources
Network Indicators:
- Downloads of Nuclei templates from untrusted repositories
- Network connections following template execution
SIEM Query:
process.name:"nuclei" AND (event.action:"template_execution" OR event.action:"code_execution")