CVE-2020-13942 Remote Code Execution in Apache Unomi
Attackers can execute arbitrary code by injecting malicious scripts into the public context endpoint of Apache Unomi.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13942?
CVE-2020-13942 is a critical code injection vulnerability in Apache Unomi, published on 24 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Which versions are affected by CVE-2020-13942?
2 open source packages ship an affected version, including org.apache.unomi:unomi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.unomi:unomi Maven | All versions | 1.5.2 |
org.apache.unomi:unomi Maven | All versions | 1.5.2 |
Products include Apache Unomi.
How do I fix CVE-2020-13942?
Upgrade org.apache.unomi:unomi to 1.5.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-13942 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-13942 exists.
Public exploit code: 1 Nuclei template and 9 proofs of concept on GitHub.
Other vulnerabilities in Apache Unomi
Sources
Also known as GHSA-xp5j-wj4h-2jq9.