Workflow extractor values in sub templates - indexed?

[bbbates-tl]

I am working on a workflow that begins with a "detect" template, and conditionally selects between two templates based on the value of a matcher. The "detect" template also uses an extractor for a value used in the subtemplates.

The workflow:

workflows:
  - template: nuclei/detect.yaml
    matchers:
      - name: p1
        subtemplates:
          - template: nuclei/p1-login.yaml
            subtemplates:
              - tags: p1
      - name: p2
        subtemplates:
          - template: nuclei/p2-login.yaml
            subtemplates:
              - tags: p2

The "detect" template:

id: detect

http:
  - raw:
      - |
        GET /config.json?_t={{unix_time()}} HTTP/1.1
        Referer: {{RootURL}}

    extractors:
      - type: json
        part: body
        name: api
        json:
          - '.api | capture("https://(?<api>[a-z0-9.-]+)/somepath") | .api'

    matchers:
      - type: word
        name: p1
        part: body
        words:
          - '"app":"p1"'
      - type: word
        name: p2
        part: body
        words:
          - '"app":"p2"'

The p2-login template:

id: p2-login

http:
  - raw:
      - |
        @Host: {{api}}   <<< using the extracted api value here
        POST /login HTTP/1.1
        Host: {{api}} <<< using the extracted api value here
        Origin: {{RootURL}}
        Referer: {{RootURL}}
        content-type: application/json
        
        {
            "email": "{{USER}}",
            "password": "{{PASSWORD}}" 
        }

The problem - when I try and use the extracted value in the subtemplates, the values appear to be wrapped in an "array".

$ nuclei -u example.org -w nuclei/myworkflow.yaml -ev -debug

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v2.9.5

		projectdiscovery.io

[INF] Current nuclei version: v2.9.5 (latest)
[INF] Current nuclei-templates version: v9.5.0 (latest)
[INF] Workflows loaded for current scan: 1
[INF] Targets loaded for current scan: 1
[INF] Running httpx on input host
[INF] Found 1 URL from httpx
[INF] [app-detect] Dumped HTTP request for https://example.org/config.json?_t=1685511098

GET /config.json?_t=1685511098 HTTP/1.1
Host: example.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Connection: close
Referer: https://example.org
X-Tl-Nuclei: me
Accept-Encoding: gzip

[DBG] [detect] Dumped HTTP response https://example.org/config.json?_t=1685511098

HTTP/1.1 200 OK
Connection: close
... SNIP ...

{"api":"https://api.example.org/somepath",  ... SNIP ...}
[INF] [p2-login] Dumped HTTP request for https://[api.example.org]/login

POST /login HTTP/1.1
Host: [api.example.org]
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 478
Origin: https://example.org
Referer: https://example.org
X-Tl-Nuclei: me
content-type: application/json
Accept-Encoding: gzip

... SNIP ...

[DBG] [p2-login] Dumped HTTP response https://[api.example.org]/login

HTTP/1.1 404 Not Found
Connection: close
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Wed, 31 May 2023 05:31:38 GMT

Interestingly, if I don't use a conditional matcher in the workflow (see below), the extracted value "works" as expected.

workflows:
  - template: nuclei/detect.yaml
    subtemplates:  # the `app` extracted value will be passed as `api.example.org` (without the square brackets)
      - template: nuclei/p2-login.yaml
        subtemplates:
          - tags: p2

Any ideas? Have I missed something?

[MetzinAround]

I wonder if matchers automatically operate as an array...

These are our current docs on workflows. Not sure if there's an answer somewhere in here: https://nuclei.projectdiscovery.io/templating-guide/workflows/#conditional-workflows

[bbbates-tl]

I couldn't find anything in the conditional workflows docs 😦 .

Only p2 is running in the output, the p1 matcher in the detect.yaml template doesn't match. The target can only be a p1 or a p2 (mutually exclusive), so the workflow matcher design is effectively an if..else block.

[MetzinAround]

Thanks!

Something about the way it's matching must be returning the information as an array.

This is pretty hacky, but is there a way to ask it to return something like foo[0] so it returns the first element in the array?

Other than that, I'm gonna ask @ehsandeep to see if they have any help they can offer.

[bbbates-tl]

Nah, using the hacky api[0] gives me a unresolved variables found: api[0] error. 😦

[MetzinAround]

Well dang, I'm sad my idea didn't work.

@ehsandeep will hopefully be able to come in and give some insight soon. Thanks!

[tovask]

a workaround until it's fixed: {{trim(api, "[]")}}

[ehsandeep]

@bbbates-tl Follow #2106 for updates; currently, accessing a specific index is not possible.

[bbbates-tl]

OK, thanks, but why does the variable get indexed when running in a conditional matcher workflow subtemplate? 🤷
As I mentioned in the OP, running a similar template without a conditional matcher passes the extracted value as expected.