Affected versions <= 3.21.1 Requires user login, then provide csrf and sessionid (copy from browser after successful login); command execution currently has no output echo. # POC +----------------------------------------------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + CVE-2020-10199 need username & password + +----------------------------------------------------------------------------------------------------------+ + USE: python3 + + EXP: python3 cve-2020-10199_poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version <= 3.21.1 + +----------------------------------------------------------------------------------------------------------+ # EXP +----------------------------------------------------------------------+ + DES: by zhzyker as https://github.com/zhzyker/exphub + + CVE-2020-10199 Nexus 3 remote command execution + +----------------------------------------------------------------------+ + USE: python3 + + EXP: python3 cve-2020-10199_cmd.py http://127.0.0.1:8081 admin admin + + VER: Nexus Repository Manager 3.x OSS / Pro <= 3.21.1 + +----------------------------------------------------------------------+ More EXP references at https://github.com/zhzyker/exphub

Query Builder