Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-xhmx-w2j4-rw3q
github.com/projectdiscovery/nuclei/v3A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access (-lfa) sandbox restriction.
Affected Component
The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connection logic did not enforce the local file access sandbox when handling the allowAllFiles DSN parameter used by LOAD DATA LOCAL INFILE.
Description
Without -lfa, Nuclei confines local file access to the templates directory. However, a javascript: template could connect to a MySQL server with allowAllFiles=true in the connection DSN. With this option enabled, a malicious MySQL server can issue LOAD DATA LOCAL INFILE requests for arbitrary paths on the scanner host. The MySQL client reads the full file contents and sends them to the server, bypassing the same sandbox that blocks direct filesystem reads through other APIs.
javascript: templates execute without the -code flag and unsigned javascript: templates run by default, making this reachable from untrusted third-party templates when scanning attacker-controlled MySQL endpoints.
[!NOTE] The
-allow-local-file-access(-lfa) option is off by default. This issue allows bypassing that restriction, not merely expanding an already-enabled capability.
Affected Users
- CLI users running untrusted or third-party
javascript:templates against MySQL-compatible targets. - SDK users who integrate Nuclei into platforms where end users can supply JavaScript templates and rely on the default
-lfarestriction to limit filesystem access.
Patches
- The vulnerability is fixed in Nuclei v3.10.0. Upgrading is strongly recommended.
- Fix reference: https://github.com/projectdiscovery/nuclei/pull/7473
Mitigation
Upgrade to Nuclei v3.10.0, where the allowAllFiles DSN option is stripped unless -lfa is explicitly enabled.
In the meantime, avoid running JavaScript templates from unverified sources, especially against untrusted database endpoints.
Workarounds
If upgrading is not an option, avoid running untrusted JavaScript templates. There is no flag or configuration that mitigates this bypass on affected versions.
Acknowledgments
Thanks to @daffainfo for reporting this issue.
Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.
Drag and drop some file here, or click to select
The vulnerability can be exploited over the network without needing physical access. It is difficult for an attacker to exploit this vulnerability and may require special conditions. An attacker does not need any special privileges or access rights. The attacker needs the user to perform some action, like clicking a link. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard