Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in Sonatype Nexus Repository 3 Pro, where disabled or locked user accounts can still log in using valid external identity provider credentials. This bypasses local account management, potentially allowing unauthorized access with previously held permissions. The main concern is confirming relevance and exposure, as the exploit requires specific external account configurations.
- Disabled accounts can still log in.
- Bypasses local access controls.
- Confirm if this affects your organization.
Attack Path
How an attacker could exploit the issue
An attacker could gain unauthorized access to a Sonatype Nexus Repository 3 Pro instance by leveraging a misconfiguration in its handling of external identity providers. If an administrator has disabled or locked a user's account within Nexus, but that user still possesses valid credentials for the connected SAML or OAuth2/OpenID Connect identity provider, the attacker can use those credentials to log in. This bypasses the local account status check, granting the attacker a new session with the privileges associated with the compromised account.
- Attacker needs valid identity provider credentials.
- Triggered when an account is disabled but active in the provider.
- Risk of unauthorized access to account privileges.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an attacker with valid identity provider credentials for a named account could bypass local account status checks in Sonatype Nexus Repository 3 Pro. This could allow a disabled or locked account to regain access and assume its previous roles, potentially affecting service behavior.
- Affected asset: Named accounts with valid credentials.
- Exposure: Bypassing local account status checks.
- Consequence: Reinstatement of account roles and access.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Sonatype Nexus Repository owner, likely a platform or infrastructure team, must first confirm the presence and reachability of the affected Nexus Repository instances. The initial step involves identifying all deployed instances, assessing their exposure, and confirming their business criticality to prioritize remediation efforts with the appropriate application or security teams.
- Platform or infrastructure team owns the issue.
- Verify instance reachability and business criticality.
- Plan remediation based on identified risk.
