CVE-2022-42889 : Apache Commons Text performs variable interpolation, allowing properties to be d

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Published 2022-10-13 13:15:10

Updated 2024-01-19 16:15:09

Source Apache Software Foundation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2022-42889

Apache » Commons Text
Versions from including (>=) 1.5 and before (<) 1.10.0
cpe:2.3:a:apache:commons_text:*:*:*:*:*:*:*:*
Matching versions
Juniper » Security Threat Response Manager
Versions before (<) 7.5.0
cpe:2.3:a:juniper:security_threat_response_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Jsa1500 » Version: N/A
When used together with: Juniper » Jsa3500 » Version: N/A
When used together with: Juniper » Jsa3800 » Version: N/A
When used together with: Juniper » Jsa5500 » Version: N/A
When used together with: Juniper » Jsa5800 » Version: N/A
When used together with: Juniper » Jsa7500 » Version: N/A
When used together with: Juniper » Jsa7800 » Version: N/A
Juniper » Security Threat Response Manager » Version: 7.5.0 Update UP1
cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up1:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Jsa1500 » Version: N/A
When used together with: Juniper » Jsa3500 » Version: N/A
When used together with: Juniper » Jsa3800 » Version: N/A
When used together with: Juniper » Jsa5500 » Version: N/A
When used together with: Juniper » Jsa5800 » Version: N/A
When used together with: Juniper » Jsa7500 » Version: N/A
When used together with: Juniper » Jsa7800 » Version: N/A
Juniper » Security Threat Response Manager » Version: 7.5.0 Update UP2
cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up2:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Jsa1500 » Version: N/A
When used together with: Juniper » Jsa3500 » Version: N/A
When used together with: Juniper » Jsa3800 » Version: N/A
When used together with: Juniper » Jsa5500 » Version: N/A
When used together with: Juniper » Jsa5800 » Version: N/A
When used together with: Juniper » Jsa7500 » Version: N/A
When used together with: Juniper » Jsa7800 » Version: N/A
Juniper » Security Threat Response Manager » Version: 7.5.0 Update UP3
cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up3:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Jsa1500 » Version: N/A
When used together with: Juniper » Jsa3500 » Version: N/A
When used together with: Juniper » Jsa3800 » Version: N/A
When used together with: Juniper » Jsa5500 » Version: N/A
When used together with: Juniper » Jsa5800 » Version: N/A
When used together with: Juniper » Jsa7500 » Version: N/A
When used together with: Juniper » Jsa7800 » Version: N/A
Juniper » Security Threat Response Manager » Version: 7.5.0
cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:-:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Jsa1500 » Version: N/A
When used together with: Juniper » Jsa3500 » Version: N/A
When used together with: Juniper » Jsa3800 » Version: N/A
When used together with: Juniper » Jsa5500 » Version: N/A
When used together with: Juniper » Jsa5800 » Version: N/A
When used together with: Juniper » Jsa7500 » Version: N/A
When used together with: Juniper » Jsa7800 » Version: N/A
Netapp » Bluexp » Version: N/A
cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-42889

EPSS FAQ

97.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-42889

Apache Commons Text RCE

Disclosure Date: 2022-10-13

First seen: 2024-01-23

exploit/multi/http/apache_commons_text4shell

More information

CVSS scores for CVE-2022-42889

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-42889

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-42889

http://seclists.org/fulldisclosure/2023/Feb/3

Full Disclosure: OXAS-ADV-2022-0002: OX App Suite Security Advisory
Mailing List;Third Party Advisory
http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html

Apache Commons Text 1.9 Remote Code Execution ≈ Packet Storm
http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html

OX App Suite Cross Site Scripting / Server-Side Request Forgery ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2022/10/13/4

oss-security - CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
Mailing List;Third Party Advisory
https://security.netapp.com/advisory/ntap-20221020-0004/

CVE-2022-42889 Apache Commons Text Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://security.gentoo.org/glsa/202301-05

Apache Commons Text: Arbitrary Code Execution (GLSA 202301-05) — Gentoo security
Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022

Security Advisory
Third Party Advisory
https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om

CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults-Apache Mail Archives
Mailing List;Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/10/18/1

oss-security - Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
Mailing List;Third Party Advisory

Jump to