CVE-2020-10199

Sonatype Nexus Repository versions before 3.21.2 contain a Java Expression Language (EL) injection flaw (CWE-917) in which attacker-supplied EL expressions are evaluated by the server, the first of two related injection issues fixed by this release. Because the CVSS vector requires only low privileges (an authenticated user) over the network with no user interaction, a low-privileged authenticated user can trigger the flaw by submitting crafted input containing EL expressions that the repository server evaluates. Successful exploitation yields remote code execution on the Nexus host with high impact on confidentiality, integrity, and availability, effectively letting the attacker run commands as the Nexus service account and access stored artifacts and configuration. Any organization running Nexus Repository 3 prior to 3.21.2 is affected, particularly instances exposed to the internet or accessible to untrusted users. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), carries an EPSS probability of 99.1%, and a public proof-of-concept for Nexus 3.21.1 is available.

What to do: Upgrade Nexus Repository to version 3.21.2 or later per vendor instructions; this release also fixes the companion (second) EL injection issue. If patching is delayed, restrict access to the Nexus UI and REST APIs to trusted authenticated accounts only, remove anonymous/untrusted access, and place internet-exposed instances behind a VPN or firewall. Hunt for signs of exploitation on instances that ran vulnerable versions, including unexpected processes or commands run as the Nexus service account.