Static Encryption Key Vulnerability in Sonatype Nexus Repository Manager

CVE-2024-5764 is a security flaw in Sonatype Nexus Repository Manager versions prior to 3.73.0, stemming from the use of a hardcoded, static encryption key within the Java PasswordCipher class. This vulnerability allows an attacker to decrypt data that was intended to be protected by this class. The flaw poses a significant risk to the confidentiality of stored credentials, API keys, or other sensitive configuration data managed by the application. A proof-of-concept Python script has been released publicly, which enables users to provide a Base64 encoded payload and decrypt the associated data, lowering the barrier to entry for potential exploitation. Defenders should prioritize patching instances of Nexus Repository Manager to version 3.73.0 or later to remediate the static key exposure.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to decrypt sensitive information protected by the PasswordCipher class. This impact includes the potential exposure of database credentials, authentication tokens, or other secrets stored by the repository manager. Organizations using Nexus Repository Manager in enterprise environments are at risk of secondary compromises if these decrypted secrets are reused across internal infrastructure.

Recommendation

• Patch all instances of Sonatype Nexus Repository Manager to version 3.73.0 or higher immediately.
• Audit logs for unauthorized access to configuration files or application secrets that may have been targeted for decryption.
• Rotate any credentials or secrets that were managed by affected versions of the Nexus Repository Manager, assuming they may have been compromised.
• Monitor for the execution of the identified exploit script or similar tooling that interacts with Nexus Repository configuration files on the host system.