CVE-2022-42889observed exploitation

CVE-2022-42889: vulnerability in Apache Commons Text

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Published 13 Oct 2022 · Updated 20 Nov 2024

84Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 100%

from disclosure to weapon4 days

Published on NVDOct 13

1st PoC+4d

metasploitOct 13

VulnCheck+91d

exploitation probability

100%top 1% of all CVEs

observed exploitation

yesVulnCheck

93 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

4 products (5 components)

Red Hat OpenShift Container Platform 3.11 · Red Hat Integration Camel K 1 · Red Hat JBoss Enterprise Application Platform 7 · Red Hat JBoss Enterprise Application Platform Expansion Pack

workaround: This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.

Fixed

18 products (129 components)

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 · OpenShift Developer Tools and Services for OCP 4.12 · OpenShift Developer Tools and Services for OCP 4.13 · and others 13

fix ↗

Not affected

20 products (2,385 components) — because the vulnerable code is not present in the product

Red Hat Satellite 6.13 for RHEL 8 · Red Hat OpenShift Container Platform 4.10 · Red Hat OpenShift Container Platform 4.9 · Red Hat Satellite 6.12 for RHEL 8 · OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 · and others 15

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Affected products

Apache Software Foundation · Apache Commons Text

public PoCs found — 93

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html http://seclists.org/fulldisclosure/2023/Feb/3 https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022 https://security.gentoo.org/glsa/202301-05 https://security.netapp.com/advisory/ntap-20221020-0004/http://www.openwall.com/lists/oss-security/2022/10/13/4 http://www.openwall.com/lists/oss-security/2022/10/18/1