# CVE-2022-42889: Apache Commons Text - RCE

> Live exploitation tracking for CVE-2022-42889 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-42889

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Apache Commons Text
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** web_application

## Description

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

## CrowdSec analysis

[CVE-2022-42889](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-42889) is a critical vulnerability in Apache Commons Text that can lead to remote code execution or unintended interaction with remote servers through variable interpolation functions. If user-supplied data is processed by the affected interpolation mechanism, attackers can trigger execution of arbitrary code or external resource access.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2022.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2022-42889 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-42889 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-42889 is currently experiencing high visibility and active exploitation across the internet.

Detection typically relies on identifying suspicious use of interpolation patterns within application input or configuration, especially where user-controlled data is present.

## Timeline

- 2022-10-13: CVE Published. CVE-2022-42889 is published to NVD.
- 2022-10-24: Rule Released. CrowdSec releases a rule to detect CVE-2022-42889 exploitation attempts against the CrowdSec Network.
- 2022-10-24: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-42889 for the first time.

## References

- https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
- https://security.netapp.com/advisory/ntap-20221020-0004/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
- https://security.gentoo.org/glsa/202301-05

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-42889) follows observed exploitation activity for CVE-2022-42889. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.