HighPublic exploitVulnerability

CVE-2024-4956

Path Traversal in Sonatype Nexus Repository 3

Published May 16, 2024 · Updated 15 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.5High · v3.1

EPSS19.2%97th percentile

CISA KEVNoNot listed

In the wildReported2 exploitation records in Mallory

Vendor: Sonatype

IdentifiersCVE-2024-4956CWE-22 · Improper Limitation of a Pathname…

CVE-2024-4956 is a path-traversal vulnerability in Sonatype Nexus Repository 3 that permits an unauthenticated attacker to read system files. The issue is fixed in Nexus Repository version 3.68.1.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation exposes system files accessible to the Nexus Repository process, potentially disclosing sensitive configuration, credential, or other host-resident data depending on file permissions and deployment configuration.

Mitigation

If you can’t patch tonight, do this now.

Until the fixed version is deployed, restrict access to Nexus Repository management and HTTP endpoints to trusted networks and authenticated reverse proxies or VPN users. Monitor web access logs for traversal-style requests and investigate unexpected file-read responses. Apply least-privilege filesystem permissions to the Nexus service account to limit the sensitivity of files it can read.

Remediation

Patch, then assume compromise.

Upgrade Sonatype Nexus Repository 3 to version 3.68.1 or a later version containing the fix.

Public exploits

Exploits

7 exploits validated by Mallory's analysis. Hidden: 5 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

CVE-2024-4956-Sonatype-Nexus-Repository-ManagerThis repository provides two exploit scripts (Python and Bash) targeting CVE-2024-4956, a path traversal vulnerability in Sonatype Nexus Repository Manager 3.x OSS/Pro up to and including 3.68.0. The vulnerability allows unauthenticated attackers to read arbitrary files from the server's filesystem by sending a specially crafted HTTP GET request with encoded path traversal sequences. The repository contains a README.md with usage instructions and references, a Python script (exploitPython.py) that takes command-line arguments for the target URL, port, and file to read, and a Bash script (exploitBash.sh) with similar functionality. Both scripts construct a URL with multiple encoded '../' sequences to traverse directories and access files outside the intended scope. The exploit is operational and can be used to retrieve sensitive files such as /etc/passwd from vulnerable servers. No authentication is required, and the attack is performed over the network via HTTP or HTTPS.Praison001 · Disclosed May 30, 2024 · python · bash · networkOperational CVE-2024-4956This repository provides a Python exploit script (cve-2024-4956.py) for CVE-2024-4956, a directory traversal vulnerability in Sonatype Nexus Repository Manager 3.x. The script allows an attacker to test if a target server is vulnerable and, if so, to automate the retrieval of arbitrary files from the server's filesystem by exploiting the path traversal flaw. The script supports mass testing of file paths (provided in paths.txt), proxying requests, and saving the contents of successfully accessed files for offline analysis. The included paths.txt file contains a comprehensive list of database files (primarily .pcl files) that may contain sensitive information such as user credentials, analytics, and security data. The exploit is operational and can be used to extract sensitive files from vulnerable Nexus servers over HTTP/S. The repository also provides references and tools for further analysis of extracted data, such as cracking Apache Shiro 1 hashes.fin3ss3g0d · Disclosed Jun 5, 2024 · python · networkOperational cve-2024-4956This repository provides an operational exploit for CVE-2024-4956, a critical path traversal vulnerability in Sonatype Nexus Repository 3 (versions prior to 3.68.1). The main exploit script, 'cve-2024-4956.py', is a Python tool that automates the exploitation process. It allows an unauthenticated attacker to test for the vulnerability and, if present, read arbitrary files from the server's filesystem by sending specially crafted HTTP GET requests with encoded traversal sequences. The script supports proxying, custom file lists (provided in 'paths.txt'), and saves retrieved files to a local output directory. The included 'paths.txt' file lists numerous internal Nexus database files that may contain sensitive information. The README provides a detailed technical overview, impact assessment, and remediation advice. The exploit is not part of a framework and is standalone. The attack vector is network-based, requiring only HTTP/S access to the vulnerable server. The repository is well-structured, with clear separation between code, documentation, and data files.XiaomingX · Disclosed Dec 12, 2024 · python · networkOperational CVE-2024-4956This repository contains a Nuclei template (CVE-2024-4956.yaml) and a detailed README.md for exploiting CVE-2024-4956, an unauthenticated path traversal vulnerability in Sonatype Nexus Repository Manager 3 (versions 3.0 to 3.68.0). The main exploit is a Nuclei YAML template that issues a crafted HTTP GET request with a path traversal payload, attempting to access the /etc/passwd file on the target server. The template checks for a 200 OK response and the presence of the 'root:' string in the response body to confirm successful exploitation. The README provides background, affected versions, mitigation advice, and a sample HTTP request for manual testing. The exploit demonstrates the ability to read arbitrary files from the server without authentication, posing a significant risk to affected systems. No hardcoded IPs or domains are present; the exploit is designed to be run against any user-specified target URL.erickfernandox · Disclosed May 23, 2024 · Framework: nuclei · yaml · markdown · networkPoC CVE-2024-4956This repository provides a Python proof-of-concept exploit for CVE-2024-4956, a path traversal vulnerability in Sonatype Nexus Repository Manager 3. The main file, CVE-2024-4956.py, allows an attacker to supply a single target or a list of targets (IP:port) and attempts to retrieve the contents of /etc/passwd and /etc/shadow by sending specially crafted HTTP GET requests that exploit the path traversal flaw. The exploit is unauthenticated and works over the network, requiring only that the target is accessible and vulnerable. The README provides usage instructions, context about the vulnerability, and post-exploitation steps (such as cracking password hashes with JohnTheRipper). The repository is structured with a single exploit script, a README, and a license file. No fake or destructive code is present; the exploit is a legitimate POC for file disclosure via path traversal.verylazytech · Disclosed Jun 9, 2024 · python · networkPoC CVE-2024-4956This repository contains a Python proof-of-concept exploit for CVE-2024-4956, a path traversal (Local File Inclusion) vulnerability in Sonatype Nexus Repository version 3.68.0-04. The main file, CVE-2024-4956.py, is a command-line tool that takes a target URL (IP:port) and a file path as arguments. It crafts a URL with a path traversal sequence to attempt to read arbitrary files from the target server's filesystem. The exploit sends an HTTP GET request to the target and prints the contents of the specified file if accessible. The README provides a brief usage description. No hardcoded endpoints or credentials are present; the tool is generic and requires user-supplied target information. The exploit is a straightforward PoC and does not include advanced features or payload customization.Buff3st-0v3rfl0w · Disclosed Aug 24, 2025 · python · markdown · networkPoC day04-nexus-4956This repository provides a proof-of-concept (POC) exploit for CVE-2024-4956, a path traversal vulnerability in Sonatype Nexus Repository 3 (versions <= 3.68.0). The repository includes a Dockerfile to build and run a vulnerable Nexus instance locally, with a custom entrypoint script that generates a random CTF flag at /opt/flag.txt. The main exploit is implemented in 'exploit.sh', a Bash script that waits for the Nexus service to start and then performs unauthenticated file reads using crafted URLs that exploit the path traversal flaw. The script demonstrates reading both /etc/passwd and the CTF flag file. The attack vector is network-based, targeting the HTTP service on port 8081. The repository is structured for educational and testing purposes, with clear instructions and a disclaimer. No detection scripts or fake exploits are present; the code is a functional POC for the described vulnerability.amalpvatayam67 · Disclosed Sep 10, 2025 · bash · dockerfile · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SonatypeNexus Repository 3application

External references

References

MITRE CVEcve.org · CVE-2024-4956 NVDnvd.nist.gov/vuln/detail/CVE-2024-4956 MITRE CWE · CWE-22Improper Limitation of a Pathname to a…support.sonatype.comsupport.sonatype.com/hc/en-us/articles/29416509323923

Activity feed

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

gurucul threat researchNews · Sep 4, 2026Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia | Community Portal | GuruculA path traversal vulnerability affecting Sonatype Nexus Repository that can enable access to files outside the intended directory.Read more ↗cyberveilleNews · Sep 3, 2026Opérateur sinophone utilise des agents IA (Claude, Qwen, DeepSeek) pour cibler des gouvernements asiatiques | CyberVeilleVulnérabilité de traversée de chemin dans Nexus exploitée dans la campagne.Read more ↗huntio blogNews · Sep 3, 2026Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across AsiaA path-traversal vulnerability affecting Nexus Repository, used by the operator as an active task workflow.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidence1Every report linking this CVE to a named adversary.

Associated malware2Malware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.