Spoofing Nuclei’s template verification
Nuclei has over 21,000 stars on GitHub and over 2.1 million downloads. The tool uses “templates,” in the form of YAML files, that define specific checks or tests for the vulnerability scanning process. Ensuring the authenticity of these templates is crucial to avoid tampered or malicious templates that are misleading or compromising the scanning process.
Nuclei has a Go regex-based signature verification process in place to ensure authenticity. The flaw stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, ProjectDiscovery explained. While Go’s verification logic considers “\r” part of the same line, the YAML parser treats it as a line break, thereby leaving room for attackers to insert malicious codes.
This, combined with the fact that Nuclei has flawed processing of multiple signature lines “digest:,” can potentially lead to an attacker injecting malicious content into a template while keeping the signature valid for the harmless portion of the template.
