Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-27920

CVE-2024-27920:
Nuclei allows unsigned code template execution through workflows

7.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-27920
GHSA ID
GHSA-w5wx-6g2r-r78q
EPSS Score
0.12678%
CWE
CWE-78
Published
3/15/2024
Updated
8/20/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/projectdiscovery/nuclei/v3go>= 3.0.0, < 3.2.03.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing validation checks in the workflow parsing logic. The security patch added critical validation in parseWorkflowTemplate (seen in the commit diff) to check: 1) if code templates require the -code flag, and 2) if templates are properly verified. The absence of these checks in vulnerable versions allowed execution of unsigned code via workflows. The CWE-78 mapping confirms this is an OS command injection vector through unvalidated code execution.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Ov*rvi*w * si*ni*i**nt s**urity ov*rsi**t w*s i**nti*i** in Nu*l*i v*, involvin* t** *x**ution o* unsi*n** *o** t*mpl*t*s t*rou** work*lows. T*is vuln*r**ility sp**i*i**lly *****ts us*rs utilizin* *ustom work*lows, pot*nti*lly *llowin* t** *x**ut

Reasoning

T** vuln*r**ility st*ms *rom missin* v*li**tion ****ks in t** work*low p*rsin* lo*i*. T** s**urity p*t** ***** *riti**l v*li**tion in p*rs*Work*lowT*mpl*t* (s**n in t** *ommit *i**) to ****k: *) i* *o** t*mpl*t*s r*quir* t** -*o** *l**, *n* *) i* t*m