An authenticated code injection vulnerability in Sonatype Nexus Repository 3 allows attackers to manipulate database connection pools to execute arbitrary code.

The vulnerability (CWE-94) stems from insufficient validation of connection-pool properties via the DataStore configuration API, which an authenticated attacker can leverage to inject malicious configurations.

This vulnerability carries a CVSS score of 8.7, indicating a high risk of total system compromise. By successfully injecting malicious properties into the DataStore configuration, an attacker can gain the ability to execute arbitrary code, potentially leading to unauthorized data access, persistence within the environment, and full system takeover. This poses a grave risk to the security of the entire repository ecosystem.

Immediate Action: Upgrade to Sonatype Nexus Repository 3 version 3.95.0 or later to implement proper restrictions on DataStore configuration settings.

Proactive Monitoring: Audit DataStore configuration changes and monitor for unusual database connection behavior or unexpected system processes originating from the repository service.

Compensating Controls: Restrict access to the configuration APIs to highly privileged, audited administrative accounts and ensure that no untrusted user can interact with the DataStore management features.

Public Exploit Available: Unknown.

This is a critical security update that must be applied immediately to prevent potential code injection and full system compromise. Organizations should ensure their Nexus instances are updated to the latest version to remediate the underlying configuration flaw.