Privilege Escalation in Sonatype Nexus Repository 3

Executive Summary

This is a privilege escalation vulnerability in Sonatype Nexus Repository 3. It allows users with the role create or role update permission to grant themselves or others elevated privileges, potentially gaining full administrative access. The issue stems from missing authorization checks in role management functions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review user roles and privileges in Sonatype Nexus Repository 3. Check for unexpected elevated permissions granted to non-administrative users. Use the Nexus Repository Manager UI or REST API to list all roles and their assigned privileges. Look for users with nx-roles-create or nx-roles-update permissions who may have granted themselves unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

If exploited, an attacker with limited permissions could escalate their access to full administrative control. This could lead to unauthorized changes, data access, or system compromise. The impact depends on the user's current privileges and the system's configuration.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to Sonatype Nexus Repository 3.97.0 or later. If upgrading is not possible, restrict nx-roles-create and nx-roles-update privileges to trusted administrators only. Review all existing roles for unexpected privileges and remove any unauthorized access. Limit web interface access to trusted networks to reduce exposure.

Useful 0 Not Useful 0