Apache Commons Text - RCE (CVE-2022-42889)
Description
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
psychologyCrowdSec Analysis
CVE-2022-42889 is a critical vulnerability in Apache Commons Text that can lead to remote code execution or unintended interaction with remote servers through variable interpolation functions. If user-supplied data is processed by the affected interpolation mechanism, attackers can trigger execution of arbitrary code or external resource access.
CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2022.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2022-42889 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-42889 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-42889 is currently experiencing high visibility and active exploitation across the internet.
Detection typically relies on identifying suspicious use of interpolation patterns within application input or configuration, especially where user-controlled data is present.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-10-13 |
| Rule Released | 2022-10-24 |
| CrowdSec First Seen | 2022-10-24 |