CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.8%
The Apache Commons Text library is prone to a remote code
execution (RCE) vulnerability dubbed
# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
CPE = "cpe:/a:apache:commons_text";
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.104439");
script_version("2023-10-18T05:05:17+0000");
script_tag(name:"last_modification", value:"2023-10-18 05:05:17 +0000 (Wed, 18 Oct 2023)");
script_tag(name:"creation_date", value:"2022-11-25 10:38:03 +0000 (Fri, 25 Nov 2022)");
script_tag(name:"cvss_base", value:"10.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2022-10-18 03:15:00 +0000 (Tue, 18 Oct 2022)");
script_cve_id("CVE-2022-42889");
script_tag(name:"qod_type", value:"executable_version_unreliable");
script_tag(name:"solution_type", value:"VendorFix");
script_name("Apache Commons Text 1.5 - 1.9 RCE Vulnerability (Text4Shell)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2022 Greenbone AG");
script_family("General");
script_dependencies("gb_apache_commons_consolidation.nasl");
script_mandatory_keys("apache/commons/text/detected");
script_tag(name:"summary", value:"The Apache Commons Text library is prone to a remote code
execution (RCE) vulnerability dubbed 'Text4Shell'.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");
script_tag(name:"insight", value:"Apache Commons Text performs variable interpolation, allowing
properties to be dynamically evaluated and expanded. The standard format for interpolation is
'${prefix:name}', where 'prefix' is used to locate an instance of
org.apache.commons.text.lookup.StringLookup that performs the interpolation. The set of default
Lookup instances included interpolators that could result in arbitrary code execution or contact
with remote servers.
These lookups are:
- 'script' - execute expressions using the JVM script execution engine (javax.script)
- 'dns' - resolve dns records
- 'url' - load values from urls, including from remote servers");
script_tag(name:"affected", value:"All of the following prerequisites needs to be fulfilled to
make an application vulnerable:
- using the Apache Commons Text library in version 1.5 through 1.9
- using the interpolation defaults
- using untrusted configuration values (e.g. from untrusted user input)
Some external resources are also mentioning that the exploitability depends on the used Java
version.");
script_tag(name:"solution", value:"- Update to version 1.10 or later which disables the affected
interpolators by default
- After updating to version 1.10 make sure that the affected application isn't enabling the
interpolators again
- If the affected interpolators are required for the application sanitize untrusted user input");
script_xref(name:"URL", value:"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om");
script_xref(name:"URL", value:"https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/");
exit(0);
}
include("host_details.inc");
include("version_func.inc");
if (isnull(port = get_app_port(cpe: CPE)))
exit(0);
if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
exit(0);
version = infos["version"];
location = infos["location"];
if (version_in_range(version: version, test_version: "1.5", test_version2: "1.9")) {
report = report_fixed_ver(installed_version: version, fixed_version: "1.10", install_path: location);
security_message(port: port, data: report);
exit(0);
}
exit(99);
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.8%