CVE-2024-40641: Unsigned Code Template Execution in projectdiscovery/nuclei
Summary
CVE-2024-40641: projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
The same CVE-2024-40641 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The projectdiscovery/nuclei package is a powerful tool used for security scanning and fingerprinting of web applications. It allows users to define custom templates for various security checks and execute them against target URLs. However, a vulnerability has been discovered in the package that enables the execution of unsigned code templates through workflows.
Vulnerability Detail
The vulnerability in projectdiscovery/nuclei allows the execution of unsigned code templates through workflows. This means that an attacker can craft a malicious template and execute it within the context of the package, potentially leading to unauthorized access, data leakage, or remote code execution. The impact of this vulnerability depends on the privileges and permissions of the user running the package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is essential to update to the fixed version of the package as soon as possible.
Conclusion
The vulnerability in projectdiscovery/nuclei allows the execution of unsigned code templates, posing a risk of unauthorized access, data leakage, or remote code execution. It is crucial for users to update to the fixed version of the package (3.3.0 or later) to mitigate this vulnerability.
See every vulnerability recorded for github.com/projectdiscovery/nuclei →
FAQ
projectdiscovery/nuclei is a security scanning and fingerprinting tool for web applications.
The vulnerability allows the execution of unsigned code templates, which can lead to unauthorized access, data leakage, or remote code execution.
Update the projectdiscovery/nuclei package to version 3.3.0 or later.
Currently, there is no known workaround. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the provided references and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/projectdiscovery/nuclei.
