CVE-2024-4956 PoC — Nexus Repository 3 - Path Traversal

Source

https://github.com/TypicalModMaker/CVE-2024-4956

Associated Vulnerability

Title: Nexus Repository 3 - Path Traversal (CVE-2024-4956)
Description:Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.

Description

Proof-Of-Concept (POC) for CVE-2024-4956

Readme

# Servers vulnerable to [CVE-2024-4956](https://support.sonatype.com/hc/en-us/articles/29416509323923-CVE-2024-4956-Nexus-Repository-3-Path-Traversal-2024-05-16)

Nexus Repository Manager 3 Unauthenticated Path Traversal

Servers running on the nexus docker image are excluded 

all-servers-from-shodan.txt - list of all sonatype nexus servers on shodan\
all-servers-vulnerable.txt - list of all vulnerable sonatype nexus servers that are vulnerable\
all-servers-running-as-root-vulnerable.txt - list of all vulnerable sonatype nexus servers that are being ran as root

check-vulnerable-servers.py - checks if /etc/passwd exists from all-servers-from-shodan.txt\
check-root-servers.py - checks if /etc/shadow exists from all-servers-from-shodan.txt\
check-private_keys.py - checks for common private key paths on root from all-servers-running-as-root-vulnerable.txt and tries to ssh as root with found keys

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →