# Breaking the Chain: Wiz Uncovers a Signature Verification Bypass in Nuclei, the Popular Vulnerability Scanner (CVE-2024-43405)

Nuclei's signature verification used regex that treated \r as non-line-break while YAML parser did, allowing injection of unverified code protocol templates.

- Payout: Research
- Severity: high
- Program: Nuclei
- Credited: Wiz Research
- Disclosed: 2025-01-03
- CVE: CVE-2024-43405
- Write-up quality: 9/10
- Original: https://www.wiz.io/blog/nuclei-signature-verification-bypass
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nuclei-signature-verification-bypass
- Tags: domain:oss impact:data-leak impact:rce kind:research platform:threat-intel sev:high technique:parser-differential technique:source-review vuln:rce vuln:signature-replay

**Target:** Nuclei template signature verification and YAML parser
**Root cause:** Signature verification used regex to extract and remove digest lines, but Go regex treats \r as part of the line while YAML parser treats it as a line break. Also, only first digest line was verified but all were removed, allowing hidden content.
**Steps:**
1. Craft a template with a valid signature on first `# digest:` line.
2. Add a second `# digest:` line followed by `\r` and malicious YAML content (e.g., `code:` block executing commands).
3. The regex `(?m)^#\sdigest:\s.+$` matches only up to `\r` (since Go regex doesn't treat `\r` as line break), so the malicious content after `\r` is not part of the digest line and remains in the template after `ReplaceAll` removes all digest lines.
4. The YAML parser interprets `\r` as a line break, so the malicious content becomes part of the template and is executed.
5. Run Nuclei with the crafted template; the code protocol executes arbitrary commands on the host.
**How found:** Wiz researchers reviewed Nuclei's signature verification code and noticed three red flags: use of regex for security-critical logic, find-first vs remove-all mismatch, and dual parser (regex vs YAML) on same content. They hypothesized a parser differential around line break handling and tested Go regex behavior with \r, confirming the bypass.
**Exploitation:** An attacker crafts a malicious Nuclei template that passes signature verification but contains hidden YAML code that executes arbitrary commands (e.g., exfiltrating /etc/shadow). The template can be distributed via community repositories or uploaded to platforms that run Nuclei templates, leading to remote code execution on the host running Nuclei.
**Insight:** When a security check and the subsequent parser interpret the same input differently, look for discrepancies in line break handling (e.g., \r vs \n) and comment syntax. Also, check if verification only validates the first occurrence while removal affects all, allowing hidden content.