oss-security - Sonatype Nexus Repository Manager 2.x weak password encryption

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAA7hUgE_9Q_sta09JaBZNezm=7O5hvaJ1DVUARxdV+MMyvGGng@mail.gmail.com>
Date: Sun, 17 Dec 2017 13:53:47 +0100
From: Raphael Geissert <atomo64@...il.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Sonatype Nexus Repository Manager 2.x weak password encryption

Hi,

The Nexus Repository Manager in at least version 2.14.5 [0] (latest of
the 2.x series), stores the LDAP bind password in an on-disk file
using PBE (bouncy castle's implementation of PBEWithSHAAnd128BitRC4).

This is all great except for:
- it using only 23 iterations[1]
- it using a hard-coded and weak password[2]

Therefore offering as much protection as a rot13 would.

Given that the same PasswordHelper containing the weak password is
present elsewhere in the code, it is very likely that this weak crypto
issue affects other passwords stored by Nexus:

- components/nexus-core/src/main/java/org/sonatype/nexus/configuration/PasswordHelper.java[3]
- components/nexus-security/src/main/java/org/sonatype/security/configuration/source/PasswordHelper.java[4]

It appears that this code is no longer used by the 3.x series.

FWIW, the on-file password is:

base64(SALT_SIZE || SALT || PBE_OUTPUT )

SALT_SIZE always being 8 (hard-coded).

N.b. I'll be filing a CVE request in a moment.
N.b. I have not contacted sonatype. I couldn't find an email address.

[0] https://help.sonatype.com/display/NXRM2/2017+Release+Notes
[1] https://github.com/sonatype/nexus-public/blob/nexus-2.x/components/nexus-ldap-common/src/main/java/org/sonatype/security/ldap/upgrade/cipher/DefaultPlexusCipher.java#L64
[2] https://github.com/sonatype/nexus-public/blob/nexus-2.x/components/nexus-ldap-common/src/main/java/org/sonatype/security/ldap/realms/persist/DefaultPasswordHelper.java
[3] https://github.com/sonatype/nexus-public/blob/nexus-2.x/components/nexus-core/src/main/java/org/sonatype/nexus/configuration/PasswordHelper.java
[4] https://github.com/sonatype/nexus-public/blob/nexus-2.x/components/nexus-security/src/main/java/org/sonatype/security/configuration/source/PasswordHelper.java

Cheers,
-- 
Raphael Geissert

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.