PT-2020-13793 · Apache · Apache Unomi

Serge Huber · Published 2020-11-18 · Updated 2022-02-10 · CVE-2020-13942

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Unomi versions prior to 1.5.2

Description It is possible to inject malicious OGNL or MVEL scripts into the "/context.json" public endpoint. This issue was partially fixed in version 1.5.1, but a new attack vector was discovered. In Apache Unomi version 1.5.2, scripts are now completely filtered from the input.

Recommendations For versions prior to 1.5.2, upgrade to the latest available version of the 1.5.x release to fix this problem. As a temporary workaround, consider restricting access to the "/context.json" endpoint until a patch is available.

Exploit

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-20

Related Identifiers

CVE-2020-13942

GHSA-XP5J-WJ4H-2JQ9

Affected Products

Apache Unomi

References · 34

• 🔥 https://github.com/eugenebmx/CVE-2020-13942 · Exploit
• 🔥 https://github.com/shifa123/CVE-2020-13942-POC- · Exploit
• 🔥 https://github.com/lp008/CVE-2020-13942 · Exploit
• 🔥 https://github.com/blackmarketer/CVE-2020-13942 · Exploit
• 🔥 https://github.com/yaunsky/Unomi-CVE-2020-13942 · Exploit
• 🔥 https://advisory.checkmarx.net/advisory/CX-2020-4284 · Exploit
• 🔥 https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13942 · Security Note
• http://unomi.apache.org./security/cve-2020-13942.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13942 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xp5j-wj4h-2jq9 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2119 · Telegram Post
• https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E · Note
• https://t.me/ckure/6101 · Telegram Post
• https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E · Note