Nexus Repository Manager (<= 2.15.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/nexus-repository-manager--2.15.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 18:57:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSonatype Nexus Repository Manager Remote Code Execution (CVE-2024-5082)https://feed.craftedsignal.io/briefs/2026-10-nexus-rce-cve-2024-5082/Thu, 29 Oct 2026 18:57:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-nexus-rce-cve-2024-5082/An authenticated remote code execution vulnerability in Sonatype Nexus Repository Manager 2 (up to 2.15.1) allows attackers to execute arbitrary code by uploading a malicious Maven artifact containing an evaluated Velocity template.CVE-2024-5082 is a remote code execution vulnerability affecting Sonatype Nexus Repository Manager 2 versions 2.15.1 and earlier. The vulnerability exists due to improper processing of Maven artifacts containing Velocity templates. An authenticated user with sufficient permissions to modify repository content can upload a crafted artifact and trigger the Velocity template engine, resulting in code execution within the security context of the Nexus JVM on the host server. Sonatype reports that this product reached end of life on June 30, 2025, and recommends migration to Nexus Repository 3.

Attack Chain

  1. Attacker authenticates to the Nexus Repository Manager using valid credentials.
  2. Attacker selects a hosted repository for which they have content update permissions.
  3. Attacker uploads a malicious Maven-style artifact containing an embedded Velocity template.
  4. Attacker modifies the artifact attributes via the Nexus API to force the content generator to process the template as velocity.
  5. Attacker triggers the template evaluation by requesting or accessing the uploaded artifact.
  6. The Nexus Repository Manager evaluates the Velocity template, leading to command execution on the host server.
  7. The process creates an outbound network connection (e.g., a reverse shell) from the Nexus host to the attacker-controlled listener.

Impact

Successful exploitation results in arbitrary command execution on the Nexus Repository host with the privileges of the Nexus JVM. While the vulnerability requires authentication, a compromised repository manager can lead to broader supply-chain contamination by allowing attackers to modify trusted artifacts or credentials stored within the repository.

Recommendation

  • Migrate from Nexus Repository Manager 2 to Nexus Repository 3 immediately, as version 2 is end-of-life and unsupported.
  • For organizations unable to migrate immediately, upgrade to Nexus Repository Manager 2.15.2, which contains the fix for CVE-2024-5082.
  • Audit access logs for authenticated users performing anomalous API interactions, particularly those involving maven-metadata.xml or attribute updates related to Velocity processing.
  • Restrict repository write permissions to only those accounts and CI/CD service principals strictly requiring them.
  • Monitor for unexpected outbound network traffic (egress) originating from the Nexus Repository host server.
]]>highadvisoryremote-code-executionmavensupply-chainsonatypecve-2024-5082