GHSA-xhmx-w2j4-rw3q: Medium severity go/github.com/projectdiscovery/nuclei/v3 vulnerability
A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access (-lfa) sandbox restriction.
Affected Component
The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connection logic did not enforce the local file access sandbox when handling the allowAllFiles DSN parameter used by LOAD DATA LOCAL INFILE.
Description
Without -lfa, Nuclei confines local file access to the templates directory. However, a javascript: template could connect to a MySQL server with allowAllFiles=true in the connection DSN. With this option enabled, a malicious MySQL server can issue LOAD DATA LOCAL INFILE requests for arbitrary paths on the scanner host. The MySQL client reads the full file contents and sends them to the server, bypassing the same sandbox that blocks direct filesystem reads through other APIs.
javascript: templates execute without the -code flag and unsigned javascript: templates run by default, making this reachable from untrusted third-party templates when scanning attacker-controlled MySQL endpoints.
[!NOTE] The -allow-local-file-access (-lfa) option is off by default. This issue allows bypassing that restriction, not merely expanding an already-enabled capability.
Affected Users
- CLI users running untrusted or third-party javascript: templates against MySQL-compatible targets. - SDK users who integrate Nuclei into platforms where end users can supply JavaScript templates and rely on the default -lfa restriction to limit filesystem access.
Patches
- The vulnerability is fixed in Nuclei v3.10.0. Upgrading is strongly recommended. - Fix reference: https://github.com/projectdiscovery/nuclei/pull/7473
Mitigation
Upgrade to Nuclei v3.10.0, where the allowAllFiles DSN option is stripped unless -lfa is explicitly enabled.
In the meantime, avoid running JavaScript templates from unverified sources, especially against untrusted database endpoints.
Workarounds
If upgrading is not an option, avoid running untrusted JavaScript templates. There is no flag or configuration that mitigates this bypass on affected versions.
Acknowledgments
Thanks to @daffainfo for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/projectdiscovery/nuclei/v3to a version that resolves this vulnerability.Fixed in 3.10.0 - Upgrade
Upgrade
Nucleito a version that resolves this vulnerability.Fixed in v3.10.0 - Compensating control
Avoid running untrusted or unverified JavaScript templates, especially against untrusted MySQL-compatible database endpoints, if upgrading is not an option.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Operators are exposed when they run untrusted third-party javascript: templates while scanning MySQL endpoints controlled by an attacker. Unsigned javascript: templates run by default, so this can be reachable without enabling code execution explicitly.
What does an attacker need to exploit it?
The attacker needs a javascript: template that creates a MySQL connection with allowAllFiles=true and a malicious MySQL server that issues LOAD DATA LOCAL INFILE requests for chosen paths on the scanner host. User interaction is required to run the template or scan the attacker-controlled endpoint.
Does disabling -allow-local-file-access prevent this attack?
No. The issue bypasses the -allow-local-file-access (-lfa) sandbox through the MySQL client's allowAllFiles DSN parameter, allowing the client to read and send arbitrary local files requested by the server.
What can be done if patching is not immediately possible?
Do not run untrusted javascript: templates, particularly against MySQL endpoints controlled by untrusted parties. Restrict template sources and avoid scanning attacker-controlled MySQL servers with templates that can set allowAllFiles=true.