SSRF in Nexus Repository 3 Email Verification

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3. An attacker with the nexus:settings:update permission can send arbitrary host and port values to the email verification endpoint. This forces the server to make outbound connections to internal or restricted network addresses, allowing network reconnaissance by observing server responses or timing differences.

Useful 0 Not Useful 0

Detection Guidance

Monitor outbound connections from your Nexus Repository server, particularly to internal or restricted network addresses. Check logs for unusual email configuration verification requests or unexpected host/port values. Use network monitoring tools to detect SSRF attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this to probe internal network addresses, potentially discovering reachable hosts and open ports. While it does not directly expose data or permanently alter configurations, it enables network reconnaissance that could be used for further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance by exposing internal network information, which could violate data protection requirements under GDPR or HIPAA if sensitive systems are discovered. Organizations must mitigate this risk to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nexus Repository to version 3.95.0 or later. Restrict the nexus:settings:update permission to only trusted administrators. Implement network-level egress controls to limit outbound connections from the server.

Useful 0 Not Useful 0