Summary

Adds a nuclei template to detect CVE-2024-3408 - D-Tale Authentication Bypass and Remote Code Execution vulnerability.

Vulnerability Details

• CVE: CVE-2024-3408
• Severity: Critical (CVSS 9.8)
• Affected: D-Tale <= 3.15.1
• Root Cause: Hardcoded Flask SECRET_KEY (“Dtale”) allows session cookie forgery, combined with unsafe pandas expression evaluation in custom filters

Template Features

• Multi-step attack chain (not just version detection)
• Forges Flask session cookie using known SECRET_KEY
• Exploits enable_custom_filters + test-filter endpoint
• OOB detection via interactsh (curl/nslookup/wget fallbacks)
• Extracts version and data_id for debugging

References

• https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb
• https://nvd.nist.gov/vuln/detail/CVE-2024-3408

Testing Notes

• Vulnerable versions: D-Tale <= 3.15.1
• Default port: 40000
• Session cookies don’t expire by default

/claim #14488