Loading...
Skip to main content
GeekWala

CVE-2022-42889 (Text4Shell) — Arbitrary code execution in...

CRITICAL

Arbitrary code execution in Apache Commons Text

Published October 13, 2022Updated February 16, 2024Source: osv

Summary

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Advisory Timeline

  • First published October 13, 2022 (1460 days ago).
  • Last revised February 16, 2024 — 491 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.apache.commons:commons-text to 1.10.0 or later
<!-- Update pom.xml dependency version to 1.10.0 for org.apache.commons:commons-text -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (2).

PackageEcosystemAffectedFixed In
com.guicedee.services:commons-text
maven
0.70.0.1, 0.70.0.1-rc1, 0.70.0.1-rc13, 0.70.0.1-rc14 (+441 more)Range-based data available
org.apache.commons:commons-text
maven
1.5, 1.6, 1.7, 1.8 (+1 more)1.10.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-42889?
Arbitrary code execution in Apache Commons Text This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-42889?
CVE-2022-42889 affects com.guicedee.services:commons-text and org.apache.commons:commons-text. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-42889 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-599f-7c49-w659

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies