Vulnerabilities > CVE-2020-10199 - Expression Language Injection vulnerability in Sonatype Nexus

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

exploit available

metasploit

NVD

Published: 2020-04-01

Updated: 2022-10-07

Summary

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

Part	Description	Count
Application	Sonatype Sonatype Nexus - Sonatype Nexus 2.0.4 Sonatype Nexus 2.0.5 Sonatype Nexus 2.0.6 Sonatype Nexus 2.1 Sonatype Nexus 2.1.1 Sonatype Nexus 2.2 Sonatype Nexus 2.3.1 Sonatype Nexus 2.4.0 Sonatype Nexus 2.5.0 Sonatype Nexus 2.5.1 Sonatype Nexus 2.6.0 Sonatype Nexus 2.6.1 Sonatype Nexus 2.6.2 Sonatype Nexus 2.6.3 Sonatype Nexus 2.6.4 Sonatype Nexus 2.6.5 Sonatype Nexus 2.7.0 Sonatype Nexus 2.7.1 Sonatype Nexus 2.11.0 Sonatype Nexus 3.0.0 Sonatype Nexus 3.15.0 Sonatype Nexus 3.21.0 Sonatype Nexus 3.21.1	46

id	EDB-ID:48343
last seen	2020-04-17
modified	2020-04-17
published	2020-04-17
reporter	Exploit-DB
source	https://www.exploit-db.com/download/48343
title	Nexus Repository Manager - Java EL Injection RCE (Metasploit)

description	This module exploits a Java Expression Language (EL) injection in Nexus Repository Manager versions up to and including 3.21.1 to execute code as the Nexus user. This is a post-authentication vulnerability, so credentials are required to exploit the bug. Any user regardless of privilege level may be used. Tested against 3.21.1-01.
id	MSF:EXPLOIT/LINUX/HTTP/NEXUS_REPO_MANAGER_EL_INJECTION
last seen	2020-06-12
modified	2020-04-22
published	2020-04-15
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10199 https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype https://support.sonatype.com/hc/en-us/articles/360044882533-CVE-2020-10199-Nexus-Repository-Manager-3-Remote-Code-Execution-2020-03-31
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/nexus_repo_manager_el_injection.rb
title	Nexus Repository Manager Java EL Injection RCE

data source	https://packetstormsecurity.com/files/download/157261/nexus_repo_manager_el_injection.rb.txt
id	PACKETSTORM:157261
last seen	2020-04-20
published	2020-04-16
reporter	Alvaro Munoz
source	https://packetstormsecurity.com/files/157261/Nexus-Repository-Manager-3.21.1-01-Remote-Code-Execution.html
title	Nexus Repository Manager 3.21.1-01 Remote Code Execution