/claim #14236

Summary

This PR adds a complete exploitation-based Nuclei template for CVE-2021-3007, a critically exploitable PHP deserialization vulnerability in Laminas/Zend Framework affecting the Zend\Http\Response\Stream destructor.

Unlike version-fingerprint templates, this detection uses a fully functional gadget-based payload that:

• Sends a serialized object to trigger exploitation
• Writes a randomly generated file on the target
• Performs an HTTP verification request to confirm successful file creation

This provides true exploitation validation instead of version-only detection.

Testing & Validation

The template was validated against a reproducible vulnerable Docker environment running laminas-http 2.14.0.

Test command used:

nuclei -u http://127.0.0.1:8080 \
  -t CVE-2021-3007.yaml \
  -debug -vv \
  -o nuclei-debug-CVE-2021-3007.log