Release notes

Nuclei v3.3.2 and v3.3.3

Two nuclei updates were released this month, full of new features, maintenance and fixed security issues.

V3.3.2 added the ActionWaitDialog type in headless protocol to simplify XSS detection, as well as issues being fixed around upgrading the GitHub API version and migrating issue templates to issue forms. A security issue was also addressed in the template signer package.

Adding even more functionality to our tools, v3.3.3 introduces Linear issue tracker support, and bug fixes for WithProxy errors and missing template_url for signed templates. On the maintenance side, support was added for fs.FS in template parsing.

interactsh v1.2.1

A minor update was made to interactsh this month, adding a PDCP auth option and fixing DNS correlation ID processing.

Nuclei Templates

July stats

9,501

A couple of big releases were made for Nuclei Templates this month, in the form of both v9.9.4 and v10.0.0. Across both of these releases, we’ve been lucky enough to gain 312 new templates, 15 first-time contributors, and 65 new CVEs!

🖨️ In response to the critical Linux CUPS printing system flaw, we’ve released a Nuclei template that will ensure you’re aware of your threat level against this vulnerability. It’s available to all ProjectDiscovery Cloud Platform users and of course in our repo as well.

Critical issues addressed in these releases include remote code execution for Moodle, unrestricted file upload in Traccar, and PHP object injection in GiveWP.

For our v10.0.0 release specifically, we wanted to highlight a brand new expansion of Nuclei Templates with a new suite that’s been specifically designed for Azure Cloud Configurations. This means that a host of specialized security checks have been added, tailored so that they work seamlessly alongside Azure services and their comprehensive components - such as VMs, App Services, SQL Databases, and more. Further details on this can be found in the GitHub release notes.

Alongside the introduction of these Azure-specific templates, we have a few critical CVE highlights to share, including remote code execution for Apache OFBiz, time-based blind SQL injection for the Zabbix Server, and UnAuth credentials exposure for Cisco Smart Licensing.

Huge thanks to our contributors on all of these releases - @GuyGoldenberg, @tovask, @alessandro, @gy741, @s4e-io, @chae1xx1os, @persona-twotwo, @soonghee2, @rahaaaiii, @asteria121, @breakpack, @nukunga, @harksu, @nechyo, @theamanrawat, @bl4ckp4r4d1s3, @bleron, @r3naissance, @ctflearner, @morgan, @karkis3c, @righettod, @rxerium, @nodauf, @mihail8531, @s4e-garage, @CodeStuffBreakThings, @Farish, @0xPugal, @Thabisocn, @icarot, @kazet, @encodedguy, @mailler, @hahwul and @adeljck.

And, congratulations to our first-time contributors: @AdallomRoy, @PeterDaveHello, @linchizhen, @Parshva87, @syntacticNaCl, @fazlearefin, @flyingllama87, @ingbunga, @thefoggiest, @oIfloraIo, @non-things, @DEVisions, @nil0x42, @willmccardell, @BrunoTeixeira1996, @eeche, @gmeghab and @iuliu8899.

Other news

Highlights

Missed our September livestream? You can catch the recorded video over on our YouTube channel, where Georgina and Jason catch you up on community developments and plans for the future: https://www.youtube.com/watch?v=8wfX6Zwny3E

During the livestream, we unveiled an exciting new venture for ProjectDiscovery community members and regular contributors - the PD Pioneers program. For more details on tiers, rewards, and to learn how to apply, visit our dedicated page: https://projectdiscovery.io/pioneers

PD’s very own Backend Developer, Tarun Koyalwar, and our AppSec Researcher, Dhiyaneshwaran, will be speaking at BSides Ahmedabad in October. Check out the schedule: https://bsidesahmedabad.in/schedule/

Azure config review templates have been featured in the tldrsec newsletter. You can read the full release here: https://tldrsec.com/p/tldr-sec-248

Our diverse community spans members from full-time bug bounty hunters to Fortune 500 security engineers.

Thanks,
The ProjectDiscovery Team

If you have any feedback or ideas for our Community Newsletter, please share them by filling out this form. You can provide links or suggestions for content that you would like to see in the newsletter.