CyberRota Analysis
AI-GeneratedNexus Repository 3 is vulnerable due to inadequate restrictions on HikariCP connection-pool properties via the DataStore configuration API, allowing users with the nx-datastores-update permission to set the connectionInitSql property. This flaw can lead to the execution of arbitrary SQL commands, potentially enabling remote code execution on the default H2 database backend. Organizations using Nexus Repository 3 should prioritize patching this vulnerability to mitigate the risk of unauthorized access and control over their database systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.