Central Security Project: Unrestricted File Upload Leading to Remote Code Execution

Description As an administrator user it is possible to create files and directories in any location on the file system of the server. This can be abused to write files to any sensitive location on the Windows file system because the Nexus process runs with SYSTEM privileges. This can allows an attacker that is able to break into the Nexus Repository Manager to elevate privileges to SYSTEM on the server and use it as pivoting point for lateral movement during an attack. In the proof-of-concept I upload a PE executable file to the user's Windows Startup Folder, achieving remote code execution the next time the user logs in. In my example simply executing calc.exe. The tests were done with an installation of Nexus Repository Manager OSS 2.14.9-01 on Microsoft Windows Server 2016 Datacenter 10.0.14393 N/A Build 1439. Additional Details Unfortunately I was unable to dig up the functions handling these HTTP requests. Steps to reproduce: Create a repo and set the "overrideLocalStorageUrl" to a folder two levels below the one you want to write files to. POST /nexus/service/local/repositories Upload a file to a directory of your choice by manipulating the "g", "a" and "v" parameters POST /nexus/service/local/artifact/maven/content Proof-Of-Concept Create repository: ``` POST /nexus/service/local/repositories HTTP/1.1 Host: nexus-host User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0) Gecko/20100101 Firefox/68.0 Accept:...