[FALSE-POSITIVE] CVE-2021-37598

Author: PineApple-LogicCreated Aug 28, 2026Updated Aug 28, 2026

Labelsfalse-positive

Template IDs or paths

markdown

-CVE-2021-37598
- http/cves/2021/CVE-2021-37598.yaml

Environment

markdown

- OS: Fedoria
- Nuclei: v3.11.1
- Go: 1.25.12

Steps To Reproduce

nuclei -t CVE-2021-37598.yaml -u http://{TESTSITE} -debug-req

Relevant dumped responses

bash

[INF] [CVE-2021-37598] Dumped HTTP request for https://localhost/wp-json

GET /wp-json HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

[INF] [CVE-2021-37598] Dumped HTTP request for https://localhost/wp-json

GET /wp-json HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0
Accept: */*
Accept-Language: en
Cookie: __cf_bm=...
Accept-Encoding: gzip

[CVE-2021-37598] [http] [medium] https://localhost/wp-json
[INF] Scan completed in 201.304128ms. 1 matches found.
[INF] HTTP connections: 2 total, 2 new, 0 reused (0.0%)

Anything else?

Problem

When the test environment is behind Cloudflare. It forces the nuclei engine to follow the redirect with a cookie. The redirect triggers the second HTTP checks, producing a false positive.

Possible Solution

Attempts to use template commands such as disabling redirects failed during my testing. Instead, an additional check at the end was added to confirm that the URL contains '?'.

yaml

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json"
    matchers:
      - type: status
        status:
          - 401
          - 403
          - 404
          - 405
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json?"
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'request_url == "{{BaseURL}}/wp-json?"'
      - type: word
        part: body
        words:
          - '"name":'
          - '"url":'
          - '"home":'
          - '"description":'
        condition: and

Source: projectdiscovery/nuclei-templates

View original on GitHub View discussion on GitHub