CVE-2024-5764: 
NixOS vulnerability analysis and mitigation

A Use of Hard-coded Credentials vulnerability (CVE-2024-5764) was discovered in Sonatype Nexus Repository versions 3.0.0 through 3.72.0. The vulnerability exists in the code responsible for encrypting secrets stored in the Nexus Repository configuration database, including SMTP credentials, HTTP proxy credentials, user tokens, and other sensitive information. The affected versions relied on a static hard-coded encryption passphrase, and while administrators could define an alternate encryption passphrase, this could only be done at first boot and could not be updated subsequently (Vendor Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. Additionally, Sonatype has assigned a CVSS v4.0 score of 5.9 (Medium) with the vector string CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) (NVD).

If an attacker gains access to the internal database of the Nexus Repository deployment and the secrets are encrypted only with the default static hard-coded encryption passphrase, all stored secrets would be trivially reversible. This affects sensitive information such as SMTP credentials, HTTP proxy credentials, user tokens, and other stored secrets (Vendor Advisory).

Sonatype strongly recommends upgrading all affected instances to Nexus Repository version 3.73.0 or later. After upgrading, administrators should follow the instructions provided at the re-encryption documentation to set a new passphrase and re-encrypt stored secrets. The new version includes a mechanism that allows configuration of an encryption passphrase, rotation with a new value, and re-encryption of any stored secrets (Vendor Advisory).

The vulnerability was discovered and reported responsibly by Dylan Evans of Maveris, LLC through Sonatype's Bug Bounty Program. Sonatype has taken a proactive approach in their outreach activities to achieve rapid remediation for their customers and users (Vendor Advisory).