Unauthenticated Path Traversal in Sonatype Nexus Repository 3

This repository provides a proof-of-concept (POC) exploit for CVE-2024-4956, a path traversal vulnerability in Sonatype Nexus Repository 3 (versions <= 3.68.0). The repository includes a Dockerfile to build and run a vulnerable Nexus instance locally, with a custom entrypoint script that generates a random CTF flag at /opt/flag.txt. The main exploit is implemented in 'exploit.sh', a Bash script that waits for the Nexus service to start and then performs unauthenticated file reads using crafted URLs that exploit the path traversal flaw. The script demonstrates reading both /etc/passwd and the CTF flag file. The attack vector is network-based, targeting the HTTP service on port 8081. The repository is structured for educational and testing purposes, with clear instructions and a disclaimer. No detection scripts or fake exploits are present; the code is a functional POC for the described vulnerability.

This repository contains a Python proof-of-concept exploit for CVE-2024-4956, a path traversal (Local File Inclusion) vulnerability in Sonatype Nexus Repository version 3.68.0-04. The main file, CVE-2024-4956.py, is a command-line tool that takes a target URL (IP:port) and a file path as arguments. It crafts a URL with a path traversal sequence to attempt to read arbitrary files from the target server's filesystem. The exploit sends an HTTP GET request to the target and prints the contents of the specified file if accessible. The README provides a brief usage description. No hardcoded endpoints or credentials are present; the tool is generic and requires user-supplied target information. The exploit is a straightforward PoC and does not include advanced features or payload customization.

This repository provides an operational exploit for CVE-2024-4956, a critical path traversal vulnerability in Sonatype Nexus Repository 3 (versions prior to 3.68.1). The main exploit script, 'cve-2024-4956.py', is a Python tool that automates the exploitation process. It allows an unauthenticated attacker to test for the vulnerability and, if present, read arbitrary files from the server's filesystem by sending specially crafted HTTP GET requests with encoded traversal sequences. The script supports proxying, custom file lists (provided in 'paths.txt'), and saves retrieved files to a local output directory. The included 'paths.txt' file lists numerous internal Nexus database files that may contain sensitive information. The README provides a detailed technical overview, impact assessment, and remediation advice. The exploit is not part of a framework and is standalone. The attack vector is network-based, requiring only HTTP/S access to the vulnerable server. The repository is well-structured, with clear separation between code, documentation, and data files.

This repository provides a Python exploit script (cve-2024-4956.py) for CVE-2024-4956, a directory traversal vulnerability in Sonatype Nexus Repository Manager 3.x. The script allows an attacker to test if a target server is vulnerable and, if so, to automate the retrieval of arbitrary files from the server's filesystem by exploiting the path traversal flaw. The script supports mass testing of file paths (provided in paths.txt), proxying requests, and saving the contents of successfully accessed files for offline analysis. The included paths.txt file contains a comprehensive list of database files (primarily .pcl files) that may contain sensitive information such as user credentials, analytics, and security data. The exploit is operational and can be used to extract sensitive files from vulnerable Nexus servers over HTTP/S. The repository also provides references and tools for further analysis of extracted data, such as cracking Apache Shiro 1 hashes.

This repository provides two exploit scripts (Python and Bash) targeting CVE-2024-4956, a path traversal vulnerability in Sonatype Nexus Repository Manager 3.x OSS/Pro up to and including 3.68.0. The vulnerability allows unauthenticated attackers to read arbitrary files from the server's filesystem by sending a specially crafted HTTP GET request with encoded path traversal sequences. The repository contains a README.md with usage instructions and references, a Python script (exploitPython.py) that takes command-line arguments for the target URL, port, and file to read, and a Bash script (exploitBash.sh) with similar functionality. Both scripts construct a URL with multiple encoded '../' sequences to traverse directories and access files outside the intended scope. The exploit is operational and can be used to retrieve sensitive files such as /etc/passwd from vulnerable servers. No authentication is required, and the attack is performed over the network via HTTP or HTTPS.

This repository provides a Python proof-of-concept exploit for CVE-2024-4956, a path traversal vulnerability in Sonatype Nexus Repository Manager 3. The main file, CVE-2024-4956.py, allows an attacker to supply a single target or a list of targets (IP:port) and attempts to retrieve the contents of /etc/passwd and /etc/shadow by sending specially crafted HTTP GET requests that exploit the path traversal flaw. The exploit is unauthenticated and works over the network, requiring only that the target is accessible and vulnerable. The README provides usage instructions, context about the vulnerability, and post-exploitation steps (such as cracking password hashes with JohnTheRipper). The repository is structured with a single exploit script, a README, and a license file. No fake or destructive code is present; the exploit is a legitimate POC for file disclosure via path traversal.

This repository contains a Nuclei template (CVE-2024-4956.yaml) and a detailed README.md for exploiting CVE-2024-4956, an unauthenticated path traversal vulnerability in Sonatype Nexus Repository Manager 3 (versions 3.0 to 3.68.0). The main exploit is a Nuclei YAML template that issues a crafted HTTP GET request with a path traversal payload, attempting to access the /etc/passwd file on the target server. The template checks for a 200 OK response and the presence of the 'root:' string in the response body to confirm successful exploitation. The README provides background, affected versions, mitigation advice, and a sample HTTP request for manual testing. The exploit demonstrates the ability to read arbitrary files from the server without authentication, posing a significant risk to affected systems. No hardcoded IPs or domains are present; the exploit is designed to be run against any user-specified target URL.