CVE-2020-13942

published 2020-11-24

CVE-2020-13942: It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was…

Priority P1 89 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	unomi	>= 1.5.0 < 1.5.2	1.5.2
apache_software_foundation	apache_unomi	>= unspecified < 1.5.2	1.5.2

Detection & IOCs extracted from sources · hover to see the quote

url /context.json↗

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Unomi MVEL Eval RCE Inbound M1 (CVE-2020-13942)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"condition|22 3a|"; content:"|22|script|3a 3a|"; distance:0; fast_pattern; reference:url,www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/; reference:cve,2020-13942; classtype:attempted-admin; sid:2031219; rev:1; metadata:affected_product Apache_HTTP_server, attack_target Server, created_at 2020_11_19, cve CVE_2020_13942, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_19;)

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Unomi OGNL Eval RCE Inbound M2 (CVE-2020-13942)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"condition|22 3a|"; content:"getClass|28|"; distance:0; nocase; content:".runtime"; distance:0; nocase; content:"getDeclaredMethods|28|"; distance:0; fast_pattern; content:".invoke|28|"; distance:0; reference:url,www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/; reference:cve,2020-13942; classtype:attempted-admin; sid:2031220; rev:1; metadata:affected_product Apache_HTTP_server, attack_target Server, created_at 2020_11_19, cve CVE_2020_13942, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_19;)

• → Exploit targets POST requests to /context.json; look for JSON body containing 'condition' key paired with a 'script::' prefixed value (MVEL vector) in the parameterValues field.
• → MVEL RCE payload is detectable in the HTTP request body by the co-occurrence of the string 'condition":' and the token 'script::' (ET SID 2031219).
• → OGNL RCE payload is detectable in the HTTP request body by the co-occurrence of 'condition":', 'getClass()', '.runtime', 'getDeclaredMethods()', and '.invoke(' (ET SID 2031220).
• → Nuclei template validates exploitation by checking response headers for both 'application/json' and 'context-profile-id', and response body for a UUID pattern alongside profile/session property keywords.
• → The condition type 'profilePropertyCondition' is used as the vehicle for injecting the malicious script payload in the parameterValues object.
• → Session ID field 'sessionId' set to a static probe value (e.g. 'nuclei') can be used as a canary to identify scanner/exploit traffic in access logs.

• · The vulnerability was only partially fixed in 1.5.1; a new attack vector remained. Full remediation requires upgrading to 1.5.2 or later where scripts are completely filtered from input. ↗
• · The /context.json endpoint is public (unauthenticated), meaning no credentials are required to attempt exploitation — network-level controls or WAF rules are the primary pre-patch mitigation. ↗
• · Executed code runs with the same permission level as the Java process hosting Apache Unomi, so the blast radius depends entirely on how the service is deployed.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20 CWE-74