Breaking corporate Maven repositories

### Overview In this presentation, Michael Stepankin, a security researcher at GitHub Security Lab, details his investigation into vulnerabilities within popular Maven repository managers and corporate artifact stores. Prompted by an initial arbitrary file read discovery on search.maven.org years earlier, Stepankin focused on the centralized nature of Maven Central and enterprise artifact proxies. Because major tech companies ingest dependencies through Maven repositories, compromising an upstream or internal repository manager provides an avenue to alter software supply chains. By auditing open-source repository engines like Sonatype Nexus (Nexus 2 and Nexus 3), JFrog Artifactory, and Reposilite, he identified multiple pre-authentication vulnerabilities that stem from proxying functionality, URL parsing differences, archive extraction, and metadata handling.

### Key Topics - **Maven Ecosystem and Proxy Repositories**: How Maven resolves dependencies declared in `pom.xml` via group ID, artifact ID, and version, downloading artifacts (`.jar` and `.pom` files) and storing them locally. Corporate environments typically route requests through in-house repository proxies (e.g., Nexus, Artifactory) to manage private packages and cache external dependencies. - **Attack Surface Expansion via Proxy Mode**: In-house proxy repositories significantly widen an application's attack surface. Even though administrative functions require authentication, proxy configurations trigger server-side archive extraction, XML parsing, local caching, and admin UI rendering in response to unauthenticated client requests. - **Archive Handling and Injection Attacks**: Stored XSS, path traversal, and remote code execution (RCE) vectors via malicious packages pulled from external or upstream repositories into local managers. - **Name Confusion and Cache Poisoning**: Inconsistencies in how different repository systems normalize paths, semicolons, and URL-encoded characters, allowing attackers to poison caches by substituting legitimate packages with arbitrary dependencies across package ecosystems (Maven, npm, Docker, RubyGems, Go).

### Technical Details - **Reposilite & Nexus Stored XSS and Path Traversal**: By injecting JavaScript into artifact content or metadata rendered in the administrative console, Stepankin achieved stored XSS. In Reposilite, the admin token secret was located in `localStorage`. He also uncovered a Zip Slip/path traversal vulnerability where Reposilite automatically unpacked javadoc archives, allowing an attacker to write a `.jar` file directly into the `workspace/plugins` directory to achieve RCE upon restart. An additional path traversal flaw in javadoc file retrieval permitted downloading files outside target folders via URL encoding, exposing user credentials from Reposilite's default SQLite database (`sqlite-jdbc`). - **Name Confusion via URL/Path Inconsistencies**: Stepankin identified that repository managers parse path parameters differently. While exploring URL-encoded separators (such as `#` and `?`), he found that a semicolon followed by path traversal sequences (`..;/`) exposed major parsing divergences: Nexus 2 treated the full path as an artifact name with an enlarged group ID; Nexus 3 normalized paths first and consumed traversal segments; and JFrog Artifactory treated characters following a semicolon as path parameters. - **JFrog Artifactory Cache Poisoning Proof-of-Concept**: When Artifactory requested an artifact from an upstream server (such as an Apache snapshots repository running Nexus 2 behind Cloudflare), the upstream returned a different artifact than Artifactory mapped. As a demonstration, Stepankin targeted npm packages on Artifactory by requesting `is-even` combined with path traversal targeting `is-odd`. Artifactory accepted the response and poisoned its internal cache, delivering `is-odd` whenever clients requested `is-even`. JFrog upgraded this finding to critical and awarded a $5,000 bounty (which was donated to cancer research). - **Parameter Manipulation & Nexus 2 RCE**: Artifactory supported special query and matrix parameters, including `remoteSiteUrl`, which could theoretically redirect upstream proxy destinations if smuggled. In Nexus 2, artifacts and internal metadata are stored directly on the file system rather than a database. Stepankin discovered an issue allowing access and manipulation of internal metadata files, escalating to remote code execution. He noted the Nexus 2 RCE can be mitigated by blocking double forward slashes (`//`) in requests.

### Takeaways Proxy modes in enterprise repository managers can expose internal networks to pre-authentication exploits because unauthenticated client requests trigger complex server-side processing on external artifacts. Furthermore, inconsistent URL and path normalization across intermediary proxies and upstream repositories enables cache poisoning across multiple package ecosystems. In total, the research uncovered seven high-to-critical CVEs across tested repository platforms.