Apache Unomi: Remote Code Execution via MVEL/OGNL Injection (CVE-2020-13942)

Apache Unomi versions prior to 1.5.2 contain a remote code execution vulnerability (CVE-2020-13942) that allows unauthenticated attackers to execute arbitrary code via malicious MVEL or OGNL expressions. The vulnerability is triggered by sending a crafted request to the /context.json endpoint, specifically targeting the parameterValue field. Publicly available exploit scripts now exist that support remote command execution and reverse shell capabilities.

Impact

Successful exploitation allows for full remote code execution on the underlying server, potentially leading to total system compromise, data exfiltration, and lateral movement within the network.

Recommendation

• Update Apache Unomi to version 1.5.2 or later immediately.
• Implement strict ingress filtering for the /context.json endpoint to block unauthorized or external access.
• Monitor web server access logs for anomalous POST requests to /context.json containing expression language syntax (e.g., MVEL, OGNL) or shell metacharacters.
• Deploy the provided detection rule to identify exploitation attempts.