CVE-2022-42889

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Apache Commons Text lleva a cabo una interpolación de variables, permitiendo que las propiedades sean evaluadas y expandidas dinámicamente. El formato estándar para la interpolación es "${prefix:name}", donde "prefix" es usado para localizar una instancia de org.apache.commons.text.lookup.StringLookup que lleva a cabo la interpolación. A partir de la versión 1.5 y hasta 1.9, el conjunto de instancias de Lookup por defecto incluía interpoladores que podían dar lugar a una ejecución de código arbitrario o al contacto con servidores remotos. Estos lookups son: - "script" - ejecuta expresiones usando el motor de ejecución de scripts de la JVM (javax.script) - "dns" - resuelve registros dns - "url" - carga valores de urls, incluso de servidores remotos Las aplicaciones usando los interpoladores por defecto en las versiones afectadas pueden ser vulnerables a una ejecución de código remota o al contacto involuntario con servidores remotos si son usados valores de configuración que no son confiables. Es recomendado a usuarios actualizar a Apache Commons Text versión 1.10.0, que deshabilita los interpoladores problemáticos por defecto

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.

*Credits: N/A

CVSS Scores

NISTv3.1 9.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-10-12 CVE Reserved
2022-10-13 CVE Published
2022-10-17 First Exploit
2024-08-03 CVE Updated
2024-11-08 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1188: Initialization of a Resource with an Insecure Default

CAPEC

References (36)

URL	Tag	Source
http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html	Third Party Advisory
http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2023/Feb/3	Mailing List
http://www.openwall.com/lists/oss-security/2022/10/13/4	Mailing List
http://www.openwall.com/lists/oss-security/2022/10/18/1	Mailing List
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022	Third Party Advisory
https://security.netapp.com/advisory/ntap-20221020-0004	Third Party Advisory
https://sysdig.com/blog/cve-2022-42889-text4shell
https://github.com/karthikuj/cve-2022-42889-text4shell-docker

URL	Date	SRC
https://github.com/SeanWrightSec/CVE-2022-42889-PoC	2022-10-20
https://github.com/kljunowsky/CVE-2022-42889-text4shell	2023-12-29
https://github.com/korteke/CVE-2022-42889-POC	2022-11-06
https://github.com/cxzero/CVE-2022-42889-text4shell	2023-03-17
https://github.com/cryxnet/CVE-2022-42889-RCE	2022-11-21
https://github.com/akshayithape-devops/CVE-2022-42889-POC	2022-10-23
https://github.com/0xst4n/CVE-2022-42889	2022-10-17
https://github.com/0xmaximus/Apache-Commons-Text-CVE-2022-42889	2022-10-23
https://github.com/gustanini/CVE-2022-42889-Text4Shell-POC	2023-06-27
https://github.com/west-wind/CVE-2022-42889	2022-10-25
https://github.com/s3l33/CVE-2022-42889	2022-10-22
https://github.com/humbss/CVE-2022-42889	2022-10-21
https://github.com/sunnyvale-it/CVE-2022-42889-PoC	2022-11-07
https://github.com/Vulnmachines/text4shell-CVE-2022-42889	2022-10-25
https://github.com/necroteddy/CVE-2022-42889	2023-04-19
https://github.com/jayaram-yalla/CVE-2022-42889-POC_TEXT4SHELL	2022-10-22
https://github.com/Gotcha-1G/CVE-2022-42889	2022-11-02
https://github.com/34006133/CVE-2022-42889	2023-09-10
https://github.com/neerazz/CVE-2022-42889	2022-10-19
https://github.com/Sic4rio/CVE-2022-42889	2023-09-06
https://github.com/rhitikwadhvana/CVE-2022-42889-Text4Shell-Exploit-POC	2022-10-22
https://github.com/galoget/CVE-2022-42889-Text4Shell-Docker	2022-10-22
https://github.com/adarshpv9746/Text4shell--Automated-exploit---CVE-2022-42889	2022-11-07

URL	Date	SRC

URL	Date	SRC
https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om	2024-01-19
https://security.gentoo.org/glsa/202301-05	2024-01-19
https://access.redhat.com/security/cve/CVE-2022-42889	2024-05-30
https://bugzilla.redhat.com/show_bug.cgi?id=2135435	2024-05-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	< 7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version " < 7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa1500 Search vendor "Juniper" for product "Jsa1500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	< 7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version " < 7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa3500 Search vendor "Juniper" for product "Jsa3500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	< 7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version " < 7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa3800 Search vendor "Juniper" for product "Jsa3800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	< 7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version " < 7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa5500 Search vendor "Juniper" for product "Jsa5500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	< 7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version " < 7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa5800 Search vendor "Juniper" for product "Jsa5800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	< 7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version " < 7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa7500 Search vendor "Juniper" for product "Jsa7500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	< 7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version " < 7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa7800 Search vendor "Juniper" for product "Jsa7800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa1500 Search vendor "Juniper" for product "Jsa1500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa3500 Search vendor "Juniper" for product "Jsa3500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa3800 Search vendor "Juniper" for product "Jsa3800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa5500 Search vendor "Juniper" for product "Jsa5500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa5800 Search vendor "Juniper" for product "Jsa5800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa7500 Search vendor "Juniper" for product "Jsa7500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	-	Affected	in	Juniper Search vendor "Juniper"	Jsa7800 Search vendor "Juniper" for product "Jsa7800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up1	Affected	in	Juniper Search vendor "Juniper"	Jsa1500 Search vendor "Juniper" for product "Jsa1500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up1	Affected	in	Juniper Search vendor "Juniper"	Jsa3500 Search vendor "Juniper" for product "Jsa3500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up1	Affected	in	Juniper Search vendor "Juniper"	Jsa3800 Search vendor "Juniper" for product "Jsa3800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up1	Affected	in	Juniper Search vendor "Juniper"	Jsa5500 Search vendor "Juniper" for product "Jsa5500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up1	Affected	in	Juniper Search vendor "Juniper"	Jsa5800 Search vendor "Juniper" for product "Jsa5800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up1	Affected	in	Juniper Search vendor "Juniper"	Jsa7500 Search vendor "Juniper" for product "Jsa7500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up1	Affected	in	Juniper Search vendor "Juniper"	Jsa7800 Search vendor "Juniper" for product "Jsa7800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up2	Affected	in	Juniper Search vendor "Juniper"	Jsa1500 Search vendor "Juniper" for product "Jsa1500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up2	Affected	in	Juniper Search vendor "Juniper"	Jsa3500 Search vendor "Juniper" for product "Jsa3500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up2	Affected	in	Juniper Search vendor "Juniper"	Jsa3800 Search vendor "Juniper" for product "Jsa3800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up2	Affected	in	Juniper Search vendor "Juniper"	Jsa5500 Search vendor "Juniper" for product "Jsa5500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up2	Affected	in	Juniper Search vendor "Juniper"	Jsa5800 Search vendor "Juniper" for product "Jsa5800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up2	Affected	in	Juniper Search vendor "Juniper"	Jsa7500 Search vendor "Juniper" for product "Jsa7500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up2	Affected	in	Juniper Search vendor "Juniper"	Jsa7800 Search vendor "Juniper" for product "Jsa7800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up3	Affected	in	Juniper Search vendor "Juniper"	Jsa1500 Search vendor "Juniper" for product "Jsa1500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up3	Affected	in	Juniper Search vendor "Juniper"	Jsa3500 Search vendor "Juniper" for product "Jsa3500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up3	Affected	in	Juniper Search vendor "Juniper"	Jsa3800 Search vendor "Juniper" for product "Jsa3800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up3	Affected	in	Juniper Search vendor "Juniper"	Jsa5500 Search vendor "Juniper" for product "Jsa5500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up3	Affected	in	Juniper Search vendor "Juniper"	Jsa5800 Search vendor "Juniper" for product "Jsa5800"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up3	Affected	in	Juniper Search vendor "Juniper"	Jsa7500 Search vendor "Juniper" for product "Jsa7500"	-	-	Safe
Juniper Search vendor "Juniper"	Security Threat Response Manager Search vendor "Juniper" for product "Security Threat Response Manager"	7.5.0 Search vendor "Juniper" for product "Security Threat Response Manager" and version "7.5.0"	up3	Affected	in	Juniper Search vendor "Juniper"	Jsa7800 Search vendor "Juniper" for product "Jsa7800"	-	-	Safe
Apache Search vendor "Apache"		Commons Text Search vendor "Apache" for product "Commons Text"				>= 1.5 < 1.10.0 Search vendor "Apache" for product "Commons Text" and version " >= 1.5 < 1.10.0"		-		Affected
Netapp Search vendor "Netapp"		Bluexp Search vendor "Netapp" for product "Bluexp"				-		-		Affected