Detections
Analytics
CVE-2022-42889
critical
Description
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
References
https://security.netapp.com/advisory/ntap-20221020-0004/
https://security.gentoo.org/glsa/202301-05
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
http://www.openwall.com/lists/oss-security/2022/10/18/1
http://www.openwall.com/lists/oss-security/2022/10/13/4
https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report
https://checkmarx.com/blog/cve-2022-42889-text4shell-vulnerability-breakdown/
https://github.com/chengbochuan3/CVE-Apache-Ecosystem
https://github.com/gabenguyen-ps/cgr.java-maven-cve-libs-demo
https://github.com/berinle/spring-enterprise-remediation-demo
https://github.com/ezequielp-activestate/bmo-cve-patches
https://github.com/Hkaeeeer/CVE-2022-42889
https://github.com/test-avm-714877d2df585126/dependabot-cve-test-2
https://github.com/heyjerrybecker/seevie-pri
https://github.com/Sansyuh06/CVE-Guard
https://github.com/banaeye/cvetest
https://github.com/neilc1964techned/craready-test-java-vulns
https://github.com/palvevaibhav/cvecheck
https://github.com/Sansyuh06/CVE-Triage-Env
https://github.com/SanderSchepers1993/CyberSec2026
https://github.com/KosmicOwl045/ICT287-CVE-2022-42889
https://github.com/sangrok-jeon/CVE-2022-42889-Analysis
https://github.com/lizuyi-6/aetherguard-security-dataset
https://github.com/engranaabubakar/CVE-2022-42889
https://github.com/venubhamidi/concert-cve-demo
https://github.com/clay-good/blastauri
https://github.com/ifconfig-me/Log4Shell-Payloads
https://github.com/gustanini/CVE-2022-42889-Text4Shell-POC
https://github.com/necroteddy/CVE-2022-42889
https://github.com/hotblac/text4shell
https://github.com/devenes/text4shell-cve-2022-42889
https://github.com/f0ng/text4shellburpscanner
https://github.com/pwnb0y/Text4shell-exploit
https://github.com/QAInsights/cve-2022-42889-jmeter
https://github.com/Hack4rLIFE/CVE-2022-42889
https://github.com/Abhi-1712/CVE-Analysis
https://github.com/smileostrich/Text4Shell-Scanner
https://github.com/0xmaximus/Apache-Commons-Text-CVE-2022-42889
https://github.com/jayaram-yalla/CVE-2022-42889-POC_TEXT4SHELL
https://github.com/s3l33/CVE-2022-42889
https://github.com/stavrosgns/Text4ShellPayloads
https://github.com/securekomodo/text4shell-scan
https://github.com/ClickCyber/cve-2022-42889
https://github.com/tulhan/commons-text-goat
https://github.com/advisories/GHSA-599f-7c49-w659
https://github.com/fullhunt/log4j-scan
https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html