Unomi-CVE-2020-13942

CVE-2020-13942 Apache Unomi Remote Code Execution Vulnerability Script

Vulnerability Overview

Apache Unomi is an open-source Java data platform, a Java server designed to manage data of customers, prospects, and visitors, and to help personalize customer experiences. Unomi can be used to integrate personalization and profile management in very different systems (e.g., CMS, CRM, issue trackers, native mobile applications, etc.).

In versions prior to Apache Unomi 1.5.1, an attacker can send malicious requests using carefully crafted MVEL or OGNL expressions, causing the Unomi server to execute arbitrary code.

This vulnerability is assigned CVE-2020-13942, with a severity level of High and a CVSS score of 7.2.

Affected Versions

Apache Unomi < 1.5.2

Script Development and Testing Environment

https://github.com/vulhub/vulhub/tree/master/unomi/CVE-2020-13942

Features

1. Execute system commands remotely

2. Reverse shell

Note: When using reverse shell, the command needs to be encoded. Encoding address: