Loading vulnerability…
Sonatype Nexus Repository Manager versions prior to 3.15.0 suffer from an incorrect access control vulnerability. The flaw allows unauthorized users to access or perform actions that should be restricted, due to improper enforcement of access control policies within the application.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a Python exploit script (CVE-2019-7238.py) targeting CVE-2019-7238, a remote code execution vulnerability in Sonatype Nexus Repository Manager 3 (versions prior to 3.15.0). The exploit abuses the /service/extdirect HTTP endpoint, which is vulnerable to JEXL injection, allowing unauthenticated attackers to execute arbitrary system commands on the server. The script supports both Linux and Windows targets, with a more elaborate payload staging process for Linux (using /etc/passwd, /tmp/passwd, and pwn.txt as temporary files to deliver and execute base64-encoded commands). The exploit is interactive, prompting the user for commands to execute on the target. The repository also includes a README.md with background information, references, and advisories. The exploit is operational and provides direct command execution capabilities, making it a practical tool for attackers or penetration testers.
This repository provides a working exploit for CVE-2019-7238, a remote code execution vulnerability in Sonatype Nexus Repository Manager 3.x (prior to 3.15.0). The exploit leverages a JEXL injection vulnerability in the /service/extdirect HTTP endpoint. The attacker crafts a POST request with a malicious JEXL expression that dynamically loads a serialized Java class (Test234) onto the server. This class executes arbitrary system commands and writes the output directly to the HTTP response, providing command execution with output (not blind). Repository structure: - README.md: Contains detailed exploit instructions, including the exact HTTP POST payload and technical notes on the vulnerability and exploitation process. - Test234.java: The Java class that is injected and executed on the server. It runs arbitrary commands and returns their output via the Jetty HTTP response. - nexus.md: Technical notes and debugging information about the vulnerability, JEXL expression handling, and Jetty internals. - trans2json.py: A helper script to generate the required JSON payload for the exploit. The exploit is operational and provides a clear path to RCE with output on vulnerable Nexus instances. The main attack vector is network-based, targeting the /service/extdirect endpoint.
This repository contains a working exploit for CVE-2019-7238, a critical unauthenticated remote code execution vulnerability in Sonatype Nexus Repository Manager 3.x versions prior to 3.15.0. The exploit is implemented in Python (CVE-2019-7238.py) and works by sending a specially crafted JSON payload to the /service/extdirect endpoint of a vulnerable Nexus instance. The payload leverages a JEXL injection to execute arbitrary Java code, which is used to run system commands on the server. The exploit does not require authentication and returns the output of the executed command. The README.md provides detailed usage instructions, example output, and demonstrates post-exploitation steps such as creating a new user and obtaining a shell via SSH. The repository is straightforward, with one main exploit script and documentation, and is operational in maturity, providing a real-world attack vector for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Nexus Repository Manager 3 vulnerability included in WatchBog’s exploit set for spreading and remote code execution.
A remote code execution vulnerability in Nexus Repository Manager listed as one of the exploits used by the Sysrv botnet for propagation.
A remote code execution vulnerability in Sonatype Nexus Repository Manager prior to version 3.15.0 that the Hide 'N Seek botnet incorporated and exploited in the wild.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.