Description

Apache Commons Text is a library focused on algorithms working on strings. Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Versions prior to 1.10.0 are vulnerable to RCE when untrusted input is used inside variable interpolation due to insecure interpolation defaults. The vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library.

Remediation

Upgrade to Apache Commons Text 1.10.0.

References

CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE

Detecting and mitigating CVE-2022-42889 a.k.a. Text4shell

Related Vulnerabilities

WordPress Plugin Cool Video Gallery Command Injection (1.9)

WordPress Plugin Ajax Search Lite Remote Command Execution (3.1)

vBulletin 5.x 0day pre-auth RCE

Cacti Unauthenticated Command Injection (CVE-2022-46169)

WordPress Plugin ProfileGrid-User Profiles, Groups and Communities Remote Code Execution (2.8.5)

Severity

Critical

Classification

CVE-2022-42889 CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution