Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-27920
Summary
The projectdiscovery/nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provides details on the security patch, and suggests mitigation strategies. Users are strongly recommended to update to a fixed version to mitigate the security risk. Users should refrain from using custom workflows if unable to upgrade immediately. Only trusted, verified workflows should be executed. This issue affects github.com/projectdiscovery/nuclei/v3 versions 3.0.x prior to 3.2.0.
- HIGH
- LOCAL
- HIGH
- CHANGED
- REQUIRED
- NONE
- HIGH
- NONE
CWE-78 - OS Command Injection
The OS command injection weakness (also known as shell injection) is a vulnerability which enables an attacker to run arbitrary OS commands on a server. This is done by modifying the intended downstream OS command and injecting arbitrary commands, enabling the execution of unauthorized OS commands. This has the potential to fully compromise the application along with all of its data, and, if the compromised process does not follow the principle of least privileges, it may compromise other parts of the hosting infrastructure as well. This weakness is listed as number ten in the 'CWE Top 25 Most Dangerous Software Weaknesses'.
References
Advisory Timeline
- Published
