[nuclei-template] ZenML CVE-2024-25723

[david-botelho-mariano]

Template Information:

This is dedicated to addressing CVE-2024-25723, a critical security vulnerability in ZenML, with an educational Proof of Concept (PoC) provided to illustrate the issue and encourage prompt mitigation. The PoC demonstrates how an unauthorized user could potentially exploit the vulnerability to take ownership of any ZenML accounts.

Source:
https://www.zenml.io/blog/critical-security-update-for-zenml-users

For the full exploit in python, visit my github repository:
https://github.com/david-botelho-mariano/exploit-CVE-2024-25723

Nuclei Template:

id: check-CVE-2024-25723-version

info:
  name: Check CVE-2024-25723 Vulnerable Version
  author: David Botelho Mariano
  severity: critical
  description: Fetches application version to check for vulnerability CVE-2024-25723.
  reference: https://www.zenml.io/blog/critical-security-update-for-zenml-users
  tags: cve,cve-2024-25723,version-check

requests:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/info"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "0.44.4"
          - "0.43.1"
          - "0.42.2"
        part: body
        condition: and
        negative:
          true

    extractors:
      - type: json
        part: body
        name: app_version
        json:
          path: "{{.version}}"
          type: string

Example response of secure version:

{"id":"16ad6b50-a8cd-43ce-b4a2-04c93350502e","version":"0.47.0","debug":false,"deployment_type":"gcp","database_type":"mysql","secrets_store_type":"sql","auth_scheme":"OAUTH2_PASSWORD_BEARER"}

Example response of vulnerable version:

{"id":"16ad6b50-a8cd-43ce-b4a2-04c93350502e","version":"0.46.0","debug":false,"deployment_type":"gcp","database_type":"mysql","secrets_store_type":"sql","auth_scheme":"OAUTH2_PASSWORD_BEARER"}

The actual logic for comparing version numbers (e.g., to see if the version is less than or equal to 0.46.7 but not one of the patched versions) is not directly supported in Nuclei's template syntax. This template focuses on identifying versions that are explicitly not patched.

[DhiyaneshGeek]

Hi @david-botelho-mariano Is it possible to update the template with Full POC

Normally for CVE based vulnerabilities we don't add version detection, since it's prone to False Positive

[david-botelho-mariano]

Hi @david-botelho-mariano Is it possible to update the template with Full POC

Normally for CVE based vulnerabilities we don't add version detection, since it's prone to False Positive

In this case, the vulnerability can only be exploited if the attacker knows the victim's username, the default username in zenml is "default" but this username can be changed, so it would create a false negative if the script only tests this user, we could test the "default", "admin" and "root" user, but that still doesn't solve the false positive issue, because the system could have a user called "adm".

The good news is that ZenML exposes the correct version to any unauthenticated user and that is what this script checks.

[david-botelho-mariano]

@GeorginaReeder

[ehsandeep]

@david-botelho-mariano Here is improved version of detection:

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/info"

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '< 0.46.7')"
          - "!contains_any(version, '0.44.4', '0.43.1', '0.42.2')"
          - "contains_all(body, 'deployment_type', 'database_type')"
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - '"version":"(.*?)"'
        internal: true