Welcome to the June edition of the ProjectDiscovery Community Newsletter. We’re well into the summer months now, but our team are still hard at work adding improvements and new features to our powerful suite of tools.
Some important updates have been made to several of our tools this month, as well as an exciting release for Nuclei Templates related to Kubernetes environments!
We also celebrated the very first of our monthly developer livestreams. With a great audience turnout and some interesting questions, we’d love to keep hosting these every month, so please don’t hesitate to reach out to us with ideas or questions from the cybersecurity space that you’d like us to cover.
Read on to discover more about what we’ve been up to over the last few weeks, and of course keep looking out for the latest news and developments in vulnerability and cybersecurity technology as we continue to share them with you. We’ll also keep highlighting contributions from our incredible community who, as always, bring fresh new ideas and innovations to our tools. And of course, don’t forget to join us on GitHub and Discord to share your thoughts and be part of the discussion!
Release notes
httpx v1.6.4
In this release, we added the -efqdn option to extract subdomains from response header and body, as well as support to exclude response body with the -sr option and support for multiple input for filter options. Issues with empty host and a missing 1XX status code in output were also fixed.
interactsh v1.2.0
This new release includes a critical security fix for the SMB option in the interactsh server. SMB is an optional feature and is disabled by default. Users utilizing -smb option should consider updating interactsh project to latest version. Support for FTP over TLS was also added.
cdncheck v1.1.0
One major change was made in this release, updating deps to bart instead of cidranger.
cvemap v0.0.7
Some new additions were made to cvemap this month, including proxy support, the option to write result to file, KnownRansomwareCampaignUse added in output, and output support updated to not omit age_in_days from output.
Nuclei Templates
June stats
This month, Nuclei Templates received a couple of updates, including an exciting major release. Between v9.8.8 and v9.9.0, 241 new templates were added along with 58 new CVEs, and the input of 12 first-time contributors.
In v9.8.8, critical and high severity issues were addressed with new CVEs - including a RCE-Remote Command Execution vulnerability in the Apache HugeGraph-Server, an Atlassian RCE vulnerability, allowing an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. We also addressed an SQL Injection vulnerability targeting theCountry State City Dropdown CF7 plugin for WordPress, via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2.
v9.9.0 saw an exciting expansion of Nuclei Templates to include a specialized set of security checks dedicated to Kubernetes environments. This covers various Kubernetes components such as Pods, Deployments, StatefulSets, Services, and Network Policies, these new templates will focus on common misconfigurations, compliance issues, and adherence to industry best practices, utilizing the enhanced capabilities like flow, code & javascript protocol. With this update, Nuclei Templates now support customizable checks that align with unique operational needs, helping teams efficiently detect and address security gaps in their Kubernetes setups.
Other great features of the v9.9.0 release include CVEs to address the Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz, a vulnerability related to template injection in the Rejetto HTTP File Server up to and including version 2.3m, and a file vulnerability in older versions of Gradio which made them susceptible to file traversal attacks.
Huge thanks to our contributors on these releases - @johnk3r, @apple, @topscoder, @david, @SecurityForEveryone, @omranisecurity, @flx, @Kazgangap, @Lucky0x0D, @charles, @drewvravick, @righettod, @idealphase, @themiddle, @Sechunt3r, @jadu101, @lu4nx, s4e-garage, @Stux, @isacaya, @nvn1729, @Ritesh_Gohil, @0xKayala, @rxerium, @geeknik, @ricardomaia, @Hel10-Web, @nvn1729 and @staticnoise.
And, congratulations to our first-time contributors: @defektive, @N0el4kLs, @moyue83, @isikabdullah44, @Dev0psSec, @icarot, @pdteamx, @L4stPL4Y3R, @chovanecadam, @NaN-KL, @vthiery and @KristinnVikar!
Other news
Highlights
How do you go about scanning large infrastrucures? Check out NahamSec’s video featuring Nuclei: https://www.youtube.com/watch?v=N2Zy9Uvv1IU
Missed our very first monthly developer livestream? It’s never too late - you can watch the full replay, including tips and tricks for authenticated scans and a preview of upcoming templates, on ProjectDiscovery’s YouTube channel: https://www.youtube.com/watch?v=nPuUF6QFNqs
Join our community
Our diverse community spans members from full-time bug bounty hunters to Fortune 500 security engineers.
Thanks,
The ProjectDiscovery Team
If you have any feedback or ideas for our Community Newsletter, please share them by filling out this form. You can provide links or suggestions for content that you would like to see in the newsletter.