CVE-2020-10199

What is Sonatype Nexus Repository?

Nexus Repository Manager is a widely used artifact repository for software development teams, storing and serving build dependencies (Maven, npm, Docker, and other package formats) for an organization's CI/CD pipelines. Because it sits in the software supply chain and is frequently reachable by build automation across an organization's development infrastructure, compromising it can provide a foothold with reach into multiple downstream projects and pipelines.

Overview

CVE-2020-10199 is an expression language injection vulnerability (CWE-917) in Nexus Repository Manager 3. A low-privileged, authenticated user can exploit it to achieve remote code execution on the server (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). It was disclosed alongside a closely related vulnerability, CVE-2020-10204, with both fixed in the same Sonatype release.

Technical Details

Certain input fields in Nexus Repository Manager are evaluated using an expression language interpreter without adequately sanitizing user-supplied content first, allowing an authenticated attacker to inject expression-language syntax that executes arbitrary code rather than being treated purely as data — the same general injection pattern as server-side template injection, applied to an expression-language evaluation context instead.

Discovery

Reported to Sonatype through its standard security disclosure process, with a fix shipped alongside the related CVE-2020-10204.

Exploitation Context

Public proof-of-concept exploit code appeared quickly after disclosure, and cryptomining campaigns — including variants associated with the Kinsing malware family — began scanning for and exploiting unpatched, internet-exposed Nexus Repository instances within weeks. As with other build/CI infrastructure vulnerabilities, compromise here is valuable to attackers both for direct resource hijacking (cryptomining) and as a potential pivot point into connected development pipelines.

Remediation

1. Update Nexus Repository Manager to the patched version addressing both this CVE and CVE-2020-10204 immediately.
2. Restrict network access to Nexus Repository Manager to trusted internal development infrastructure; it should not be directly internet-facing.
3. Apply least-privilege principles to Nexus user accounts, since exploitation requires only low-privileged authenticated access rather than full administrative rights.
4. Monitor for unauthorized processes or unexpected CPU/resource usage on Nexus hosts, given this vulnerability's documented history of cryptomining exploitation.