CVE-2020-11975
published 2020-06-05CVE-2020-11975: Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the…
PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
29.89%
98.0th percentile
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | unomi | < 1.5.1 | 1.5.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →POST request to /context.json with a JSON body containing OGNL expression in the 'propertyName' field under a profilePropertyCondition is the exploit delivery mechanism. ↗
- →Exploit payload uses the 'personalizations' key with a 'profilePropertyCondition' type and OGNL static class invocation (@java.lang.Runtime@getRuntime()) in the propertyName field — monitor POST bodies to /context.json for this pattern. ↗
- →Successful exploitation returns HTTP 200 or 500 with a JSON body containing both 'profileId' and 'sessionId' fields and Content-Type application/json. ↗
- →Shodan/FOFA fingerprint for exposed Apache Unomi instances: HTTP title 'Apache Unomi'. ↗
- →DNS interaction (OOB callback via curl) can be used to confirm blind RCE — monitor for outbound DNS/HTTP from the Unomi Java process following a POST to /context.json. ↗
- ·The OGNL injection is delivered inside the 'personalizations' array of the /context.json request body; the vulnerable parameter is 'propertyName' within a 'profilePropertyCondition' type condition — only Apache Unomi instances with OGNL scripting enabled in conditions are exploitable. ↗
- ·The exploit runs with the privilege level of the Java process hosting Apache Unomi — impact severity depends on the OS user running the JVM. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Input Validation in Apache Unomi
osv·2022-02-09
CVE-2020-11975 [HIGH] Improper Input Validation in Apache Unomi
Improper Input Validation in Apache Unomi
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
GHSA
Improper Input Validation in Apache Unomi
ghsa·2022-02-09
CVE-2020-11975 [HIGH] CWE-20 Improper Input Validation in Apache Unomi
Improper Input Validation in Apache Unomi
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
VulnCheck
Apache Unomi OGNL Scripting Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-11975 [CRITICAL] Apache Unomi OGNL Scripting Vulnerability
Apache Unomi OGNL Scripting Vulnerability
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Affected: Apache unomi
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/
Exploit PoC: https://vulncheck.com/xdb/49057f538100
No detection rules found.
Nuclei
Apache Unomi - Remote Code Execution
nuclei·CVSS 9.8
CVE-2020-11975 [CRITICAL] Apache Unomi - Remote Code Execution
Apache Unomi - Remote Code Execution
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code.
Template:
id: CVE-2020-11975
info:
name: Apache Unomi - Remote Code Execution
author: Sourabh-Sahu
severity: critical
description: |
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code.
impact: |
Successful exploitation allows an attacker to execute arbitrary code on the server with the privileges of the Java proce
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
CVE-2020-28188 [HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
# Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020. Several newly observed exploits, including CVE-2020-28188, CVE-2020-17519, and CVE-2020-29227, have emerged and were continuously being exploited in the wild as of late 2020 to early 2021.
This blog provides details of the newly observed exploits as well as a dive deep into the exploitation analysis, vendor analysis, attack origin, and attack category distribution.
Palo Alto Networks Next-Generation Firewall customers are protected from these attacks with the URL Filtering an
Unit42
Network Attack Trends: Internet of Threats (November 2020-January 2021)
blogs_unit42·2021-04-12·CVSS 7.5
[HIGH] Network Attack Trends: Internet of Threats (November 2020-January 2021)
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: Internet of Threats (November 2020-January 2021)
Lei Xu
Yue Guan
Vaibhav Singhal
Published: April 12, 2021
Malware
Trend Reports
Vulnerabilities
Botnet
DDoS
Exploit kit
IoT
Network security trends
## Executive Summary
Unit 42 researchers analyzed network attack trends over Winter 2020 and discovered many interesting exploits in the wild. During the period of Nov. 2020 to Jan. 2021, the majority of the attacks we observed were classified as critical (75%), compared to the 50.4% we reported in the fall of 2020 . Several newly observed exploits, including CVE-2020-28188 , CVE-2020-17519 , and CVE-2020-29227 , have emerged and were continuously being exploited in the wild as of late 2020 to earl
http://unomi.apache.org/security/cve-2020-11975.txthttps://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3Ehttps://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3Ehttp://unomi.apache.org/security/cve-2020-11975.txthttps://lists.apache.org/thread.html/r01021bc4b25c1e98812efca0b07f0e078a6281bd52f7c3817a429d95%40%3Ccommits.unomi.apache.org%3Ehttps://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E
2020-06-05
Published
Exploited in the wild