Nuclei Patches High Severity Flaw in Security Tool

Open-source vulnerability scanner Nuclei patched a critical flaw in its open-source vulnerability management tool ProjectDiscovery, which has over 2.1 million downloads.

See Also: Cloud Security and the Evolving Role of the Firewall

Security firm Wiz uncovered the flaw, a signature verification system flaw that could allow attackers to bypass signature checks and execute malicious code using custom code templates.

“Given Nuclei’s widespread adoption in the security community, we recognized the potential industry-wide impact of any vulnerabilities in the tool,” said Guy Goldenberg, a Wiz software engineer. “This led us to closely examine Nuclei’s codebase, resulting in the discovery of CVE-2024-43405, a high-severity vulnerability with far-reaching implications.

Goldenberg said the flaw stems from a discrepancy in how Nuclei’s signature verification syntax regular expression or regex – and its data serialization language YAML parser – handle newline characters. While the regex-based signature parser identifies lines starting with # digest:, the YAML parser treats # digest: as a comment, ignoring it during execution – causing a mismatch.

“This divergence highlights a potential weak point where verification and execution processes might not align perfectly,” Goldenberg said.

To exploit the flaw, the researcher chained the two features using /r, which is interpreted as a line by regex, and as a line break by the YAML parser.

“By chaining these weaknesses, an attacker can inject unverified, executable content into Nuclei templates – exploiting the identified weaknesses to create a practical vulnerability.”

Those organizations that run untrusted or community-contributed templates and automated scanning platforms without proper validation or isolation are at the risk of potential exploitation using the flaw. Attackers can use the flaw to inject malicious templates for data exfiltration, or system compromise.

Nuclei patched the flaw in August 2024 after being alerted by Wiz.

In addition to patching, Wiz recommended users run their projects in a sandboxed or highly isolated environment.

The U.S. Cybersecurity and Infrastructure Security Agency is among national cyber agencies warning about the rising risk of open-source vulnerabilities in software repositories, especially from nation-state hackers.

A 2024 report by security firm Sonatype that analyzed 7 million open-source projects found over 500,000 of the projects contained a malicious package. Owing to the rise in attacks, CISA in July announced that it would create a new framework to improve open-source security.