Hackers Started Exploiting Critical "Text4Shell" Apache Commons Text Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-33980 | Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default. NVD description · AI analysis pending | 9.8 | 45% |
| — | ||
| CVE-2022-42889 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default. NVD description · AI analysis pending | 9.8 | 100% |
| — |
Full article471 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 21, 2022
WordPress security company Wordfence on Thursday said it started detecting exploitation attempts targeting the newly disclosed flaw in Apache Commons Text on October 18, 2022.
The vulnerability, tracked as CVE-2022-42889 aka Text4Shell, has been assigned a severity ranking of 9.8 out of a possible 10.0 on the CVSS scale and affects versions 1.5 through 1.9 of the library.
It's also similar to the now infamous Log4Shell vulnerability in that the issue is rooted in the manner string substitutions carried out during DNS, script, and URL lookups could lead to the execution of arbitrary code on susceptible systems when passing untrusted input.
"The attacker can send a crafted payload remotely using 'script,' 'dns,' and 'url' lookups to achieve arbitrary remote code execution," the Zscaler ThreatLabZ team explained.
A successful exploitation of the flaw can enable a threat actor to open a reverse shell connection with the vulnerable application simply via a specially crafted payload, effectively opening the door for follow-on attacks.
While the issue was originally reported in early March 2022, the Apache Software Foundation (ASF) released an updated version of the software (1.10.0) on September 24, followed by issuing an advisory only last week on October 13.
"Fortunately, not all users of this library would be affected by this vulnerability – unlike Log4j in the Log4Shell vulnerability, which, which was vulnerable even in its most basic use-cases," Checkmarx researcher Yaniv Nizry said.
"Apache Commons Text must be used in a certain way to expose the attack surface and make the vulnerability exploitable."
Wordfence also reiterated that the likelihood of successful exploitation is significantly limited in scope when compared to Log4j, with most of the payloads observed so far designed to scan for vulnerable installations.
"A successful attempt would result in the victim site making a DNS query to the attacker-controlled listener domain," Wordfence researcher Ram Gall said, adding requests with script and URL prefixes have been comparatively lower in volume.
If anything, the development is yet another indication of the potential security risks posed by third-party open source dependencies, necessitating that organizations routinely assess their attack surface and set up appropriate patch management strategies.
Users who have direct dependencies on Apache Commons Text are recommended to upgrade to the fixed version to mitigate potential threats. According to Maven Repository, as many as 2,593 projects use the library, although Flashpoint noted that very few of those listed use the vulnerable method.
The Apache Commons Text flaw also follows another critical security weakness that was disclosed in Apache Commons Configuration in July 2022 (CVE-2022-33980, CVSS score: 9.8), which could result in arbitrary code execution through the variable interpolation functionality.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/10/hackers-started-exploiting-critical.html