cnvd - cnvd-2021-11849

cnvd-2021-11849

Vulnerability from cnvd

Title: Apache Unomi远程代码执行漏洞

Description:

Apache Unomi是一个可用于多系统的java开源客户数据平台，用于管理用户配置文件和与该配置文件相关的数据，Unomi在2019年被宣布成为Apache的顶级项目。由于Apache Unomi是作为运行在Apache Karaf中的OSGi应用程序构建的，因此它具有极好的可扩展性和易用性。

Apache Unomi在1.5.2之前版本中存在远程代码执行漏洞。该平台具有内置的规则系统和用户细分的概念，当用户需要为配置文件下发数据时，可以使用OGNL或MVEL类的表达式语言未受限制的执行查询操作，从而导致了Unomi容易受到表达式注入攻击，攻击者可以利用该漏洞发送符合语法的恶意表达式使Unomi服务器执行任意代码和系统命令。

Severity: 高

Patch Name: Apache Unomi远程代码执行漏洞的补丁

Patch Description:

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://unomi.apache.org./security/cve-2020-13942.txt

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-13942

Impacted products

Name
Apache Apache Unomi <1.5.2

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-13942",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-13942"
    }
  },
  "description": "Apache Unomi\u662f\u4e00\u4e2a\u53ef\u7528\u4e8e\u591a\u7cfb\u7edf\u7684java\u5f00\u6e90\u5ba2\u6237\u6570\u636e\u5e73\u53f0\uff0c\u7528\u4e8e\u7ba1\u7406\u7528\u6237\u914d\u7f6e\u6587\u4ef6\u548c\u4e0e\u8be5\u914d\u7f6e\u6587\u4ef6\u76f8\u5173\u7684\u6570\u636e\uff0cUnomi\u57282019\u5e74\u88ab\u5ba3\u5e03\u6210\u4e3aApache\u7684\u9876\u7ea7\u9879\u76ee\u3002\u7531\u4e8eApache Unomi\u662f\u4f5c\u4e3a\u8fd0\u884c\u5728Apache Karaf\u4e2d\u7684OSGi\u5e94\u7528\u7a0b\u5e8f\u6784\u5efa\u7684\uff0c\u56e0\u6b64\u5b83\u5177\u6709\u6781\u597d\u7684\u53ef\u6269\u5c55\u6027\u548c\u6613\u7528\u6027\u3002\n\nApache Unomi\u57281.5.2\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8be5\u5e73\u53f0\u5177\u6709\u5185\u7f6e\u7684\u89c4\u5219\u7cfb\u7edf\u548c\u7528\u6237\u7ec6\u5206\u7684\u6982\u5ff5\uff0c\u5f53\u7528\u6237\u9700\u8981\u4e3a\u914d\u7f6e\u6587\u4ef6\u4e0b\u53d1\u6570\u636e\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528OGNL\u6216MVEL\u7c7b\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u672a\u53d7\u9650\u5236\u7684\u6267\u884c\u67e5\u8be2\u64cd\u4f5c\uff0c\u4ece\u800c\u5bfc\u81f4\u4e86Unomi\u5bb9\u6613\u53d7\u5230\u8868\u8fbe\u5f0f\u6ce8\u5165\u653b\u51fb\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u9001\u7b26\u5408\u8bed\u6cd5\u7684\u6076\u610f\u8868\u8fbe\u5f0f\u4f7fUnomi\u670d\u52a1\u5668\u6267\u884c\u4efb\u610f\u4ee3\u7801\u548c\u7cfb\u7edf\u547d\u4ee4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://unomi.apache.org./security/cve-2020-13942.txt",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-11849",
  "openTime": "2021-02-23",
  "patchDescription": "Apache Unomi\u662f\u4e00\u4e2a\u53ef\u7528\u4e8e\u591a\u7cfb\u7edf\u7684java\u5f00\u6e90\u5ba2\u6237\u6570\u636e\u5e73\u53f0\uff0c\u7528\u4e8e\u7ba1\u7406\u7528\u6237\u914d\u7f6e\u6587\u4ef6\u548c\u4e0e\u8be5\u914d\u7f6e\u6587\u4ef6\u76f8\u5173\u7684\u6570\u636e\uff0cUnomi\u57282019\u5e74\u88ab\u5ba3\u5e03\u6210\u4e3aApache\u7684\u9876\u7ea7\u9879\u76ee\u3002\u7531\u4e8eApache Unomi\u662f\u4f5c\u4e3a\u8fd0\u884c\u5728Apache Karaf\u4e2d\u7684OSGi\u5e94\u7528\u7a0b\u5e8f\u6784\u5efa\u7684\uff0c\u56e0\u6b64\u5b83\u5177\u6709\u6781\u597d\u7684\u53ef\u6269\u5c55\u6027\u548c\u6613\u7528\u6027\u3002\r\n\r\nApache Unomi\u57281.5.2\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8be5\u5e73\u53f0\u5177\u6709\u5185\u7f6e\u7684\u89c4\u5219\u7cfb\u7edf\u548c\u7528\u6237\u7ec6\u5206\u7684\u6982\u5ff5\uff0c\u5f53\u7528\u6237\u9700\u8981\u4e3a\u914d\u7f6e\u6587\u4ef6\u4e0b\u53d1\u6570\u636e\u65f6\uff0c\u53ef\u4ee5\u4f7f\u7528OGNL\u6216MVEL\u7c7b\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u672a\u53d7\u9650\u5236\u7684\u6267\u884c\u67e5\u8be2\u64cd\u4f5c\uff0c\u4ece\u800c\u5bfc\u81f4\u4e86Unomi\u5bb9\u6613\u53d7\u5230\u8868\u8fbe\u5f0f\u6ce8\u5165\u653b\u51fb\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8be5\u6f0f\u6d1e\u53d1\u9001\u7b26\u5408\u8bed\u6cd5\u7684\u6076\u610f\u8868\u8fbe\u5f0f\u4f7fUnomi\u670d\u52a1\u5668\u6267\u884c\u4efb\u610f\u4ee3\u7801\u548c\u7cfb\u7edf\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Unomi\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache Apache Unomi \u003c1.5.2"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-13942",
  "serverity": "\u9ad8",
  "submitTime": "2020-11-23",
  "title": "Apache Unomi\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2020-13942 (GCVE-0-2020-13942)

Vulnerability from cvelistv5

Published

2020-11-24 18:00

Modified

2025-02-13 16:27

Severity ?

CWE

CWE-20 - Improper Input Validation

Summary

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.

References

▼	URL	Tags
	http://unomi.apache.org./security/cve-2020-13942.txt	x_refsource_MISC
	https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2020/11/24/5	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E	mailing-list, x_refsource_MLIST
	https://advisory.checkmarx.net/advisory/CX-2020-4284	x_refsource_MISC
	https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Unomi	Version: unspecified < 1.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://unomi.apache.org./security/cve-2020-13942.txt"
          },
          {
            "name": "[unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E"
          },
          {
            "name": "[unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E"
          },
          {
            "name": "[unomi-users] 20201124 Apache Unomi 1.5.4 Release",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E"
          },
          {
            "name": "[unomi-dev] 20201124 Apache Unomi 1.5.4 Release",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E"
          },
          {
            "name": "[oss-security] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/11/24/5"
          },
          {
            "name": "[announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://advisory.checkmarx.net/advisory/CX-2020-4284"
          },
          {
            "name": "[unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Unomi",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.5.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-04T12:34:05.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://unomi.apache.org./security/cve-2020-13942.txt"
        },
        {
          "name": "[unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cdev.unomi.apache.org%3E"
        },
        {
          "name": "[unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a%40%3Cusers.unomi.apache.org%3E"
        },
        {
          "name": "[unomi-users] 20201124 Apache Unomi 1.5.4 Release",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cusers.unomi.apache.org%3E"
        },
        {
          "name": "[unomi-dev] 20201124 Apache Unomi 1.5.4 Release",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118%40%3Cdev.unomi.apache.org%3E"
        },
        {
          "name": "[oss-security] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/11/24/5"
        },
        {
          "name": "[announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f%40%3Cannounce.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://advisory.checkmarx.net/advisory/CX-2020-4284"
        },
        {
          "name": "[unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460%40%3Ccommits.unomi.apache.org%3E"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution in Apache Unomi",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-13942",
          "STATE": "PUBLIC",
          "TITLE": "Remote Code Execution in Apache Unomi"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Unomi",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.5.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20 Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://unomi.apache.org./security/cve-2020-13942.txt",
              "refsource": "MISC",
              "url": "http://unomi.apache.org./security/cve-2020-13942.txt"
            },
            {
              "name": "[unomi-dev] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a@%3Cdev.unomi.apache.org%3E"
            },
            {
              "name": "[unomi-users] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rcb6d2eafcf15def433aaddfa06738e5faa5060cef2647769e178999a@%3Cusers.unomi.apache.org%3E"
            },
            {
              "name": "[unomi-users] 20201124 Apache Unomi 1.5.4 Release",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cusers.unomi.apache.org%3E"
            },
            {
              "name": "[unomi-dev] 20201124 Apache Unomi 1.5.4 Release",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4a8fa91836687eaca42b5420a778ca8c8fd3a3740e4cf4401acc9118@%3Cdev.unomi.apache.org%3E"
            },
            {
              "name": "[oss-security] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/11/24/5"
            },
            {
              "name": "[announce] 20201124 CVE-2020-13942: Remote Code Execution in Apache Unomi",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r08a4057ff7196b8880117edaa4b6207cbd36ed692d8dd1f5a56b4d0f@%3Cannounce.apache.org%3E"
            },
            {
              "name": "https://advisory.checkmarx.net/advisory/CX-2020-4284",
              "refsource": "MISC",
              "url": "https://advisory.checkmarx.net/advisory/CX-2020-4284"
            },
            {
              "name": "[unomi-commits] 20210428 svn commit: r1889256 - in /unomi/website: contribute-release-guide.html documentation.html download.html index.html security/cve-2021-31164.txt",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r79672c25e0ef9bb4b9148376281200a8e61c6d5ef5bb705e9a363460@%3Ccommits.unomi.apache.org%3E"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-13942",
    "datePublished": "2020-11-24T18:00:16.000Z",
    "dateReserved": "2020-06-08T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:27:30.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted