Nexus Repository 3.68.0
vulnerable target
The base image sonatype/nexus3:3.68.0, which is vulnerable to CVE-2024-4956. It listens on port 8081 and serves as the target for the path traversal exploit.
Dockerfile:5README.md:3amalpvatayam67/day04-nexus-4956
PoC files
5 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact contains a bash script (exploit.sh) that sends crafted HTTP requests to a vulnerable Nexus Repository 3 instance to read arbitrary files, including /etc/passwd and a CTF flag file, via an unauthenticated path traversal vulnerability (CVE-2024-4956).
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, README, and exploit script for a CVE-2024-4956 proof-of-concept. All files are plain text and contain no obfuscation, concealed executable behavior, or operator-directed harm. The Dockerfile builds a vulnerable Nexus container and copies a local entrypoint script (not supplied in the evidence). The exploit script performs path traversal requests against the local container to read /etc/passwd and a CTF flag. No backdoor, trojan, or suspicious behavior is observed in the reviewed content.
ClassificationExploit
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The exploit.sh script actively sends crafted HTTP requests to exploit a path traversal vulnerability and retrieve file contents, which is the definition of exploit code.
exploit.sh:14-19Requirements
- A running instance of Sonatype Nexus Repository 3 version 3.68.0 or earlier, accessible over the network.
Dockerfile:5README.md:4
Observed behavior
- Sends an HTTP GET request with a URL-encoded path traversal payload to read /etc/passwd from the target server.
exploit.sh:14-15 - Sends an HTTP GET request with a URL-encoded path traversal payload to read /opt/flag.txt from the target server.
exploit.sh:18-19
Behaviors behind the backdoor verdict
Observables
- Network Request
- curl -s "$BASE//%2f%2f%2f%2f%2f%2f%2f%2f..%2f..%2f..%2f..%2fetc%2fpasswd"Exploit script performs a path traversal request to read /etc/passwd from the local Nexus container, consistent with the described CVE.
exploit.sh:15 - Network Request
- curl -s "$BASE//%2f%2f%2f%2f%2f%2f%2f%2f..%2f..%2f..%2f..%2fopt%2fflag.txt"Exploit script reads a CTF flag file from the container, consistent with the lab exercise described in the README.
exploit.sh:19 - File Reference
- entrypoint.shDockerfile copies a local entrypoint.sh script into the container. The content of this script is not included in the evidence, so its behavior cannot be reviewed.
Dockerfile:9
What the analysis did not establish
- The evidence does not include the entrypoint.sh script referenced in the Dockerfile, so the full container setup cannot be analyzed.
- The evidence does not include the two files omitted from the packet (file_metadata_omitted: 2), so their content is unknown.
- The entrypoint.sh script referenced in the Dockerfile is not included in the evidence; its contents are unknown and could not be reviewed.
- Two text files (total 5 files in artifact) are omitted from the evidence packet; their content is unknown.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubRepository root
Created Vuln labCVE-2024-4956Dockerfile
Analysis
Environment assessment
A Docker-based lab for CVE-2024-4956, a path traversal vulnerability in Nexus Repository 3. It uses a vulnerable Nexus 3.68.0 image, adds a custom entrypoint to generate a flag file, and provides an exploit script to read arbitrary files via crafted URLs.
Dockerfile:1-13README.md:1-17Lab assessment
Vulnerability labThe README explicitly states the lab demonstrates CVE-2024-4956, a path traversal in Nexus Repository 3. The Dockerfile uses a vulnerable version (3.68.0), and the exploit script performs the traversal to read /etc/passwd and a flag file, confirming the vulnerability research purpose.
README.md:1-3Dockerfile:5exploit.sh:14-18Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
entrypoint.sh
flag generatorservice launcher
A custom entrypoint script that generates a random flag file at /opt/flag.txt if it does not exist, then hands off to the real Nexus launcher. It runs as root due to the Dockerfile USER directive.
entrypoint.sh:1-24Dockerfile:7-11exploit.sh
exploit demonstration
A bash script that waits for Nexus to boot, then sends crafted HTTP requests to read /etc/passwd and the flag file via the path traversal vulnerability.
exploit.sh:1-20How the supplied evidence relates each vulnerability
CVE-2024-4956
Supported by supplied evidence
The lab uses Nexus 3.68.0, which the README states is vulnerable (≤3.68.0). The exploit script demonstrates unauthenticated path traversal by reading /etc/passwd and /opt/flag.txt via a crafted URL, matching the advisory description.
README.md:1-3Dockerfile:5exploit.sh:14-18Requirements and sequence described by the evidence
Prerequisites
- Docker must be installed to build and run the container.
README.md:8-10 - The container must be running and Nexus fully booted (1-2 minutes) before running the exploit.
README.md:10-11exploit.sh:6-11
Evidence-described exercise path
- Build the Docker image using the provided Dockerfile.
README.md:9 - Run the container, mapping port 8081 to the host.
README.md:10 - Wait for Nexus to finish booting (monitor logs or use the exploit script's wait loop).
README.md:11exploit.sh:6-11 - Execute the exploit script (or manually send crafted requests) to read /etc/passwd and the flag file via path traversal.
exploit.sh:14-18
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior targets the lab's own container. The entrypoint generates a flag and starts Nexus; the exploit reads files inside the container via the documented vulnerability. No host escape, external connections, persistence, credential theft, or destructive actions are observed.
entrypoint.sh:1-24exploit.sh:1-20Dockerfile:1-13What the analysis did not establish
- The DISCLAIMER.md file is not included in evidence_files, so its content cannot be assessed.
- The entrypoint.sh file contains duplicated lines (lines 1-12 repeated in lines 13-24), which may indicate a copy-paste error but does not affect the analysis.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.