Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
Burp Bounty profile for detecting Apache Text4Shell (CVE-2022-42889), an RCE in Commons Text 1.5-1.9, by scanning HTTP requests.
RCE PoC for Apache Commons Text vuln
Automated exploit for CVE-2022-42889 (Text4Shell) with a vulnerable Dockerized app for testing and manual exploitation guidance.
A simple dockerize application that shows how to exploit the CVE-2022-42889 vulnerability.
This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889.
cve-2022-42889 Text4Shell CVE-2022-42889 affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10.
Proof of Concept for CVE-2022-42889 (Text4Shell Vulnerability)
CVE-2022-42889 aka Text4Shell research & PoC
Kubernetes Lab for CVE-2022-42889
Docker-based lab environment to demonstrate and test the CVE-2022-42889 (Text4Shell) remote code execution vulnerability in Apache Commons Text.
Docker-based lab environment to reproduce and test CVE-2022-42889 (Text4Shell) remote code execution vulnerability in Apache Commons Text.
Python exploit for CVE-2022-42889 (Text4Shell) enabling remote code execution via Apache Commons Text interpolation. Supports reverse shell generation, SSRF, and custom command execution.
CVE-2022-42889 - Text4Shell exploit
Proof of Concept (PoC) for CVE-2022-42889 (Text4Shell) targeting Apache Commons Text versions prior to 1.10.0. This script automates Remote Code Execution (RCE) via script interpolation to establish a reverse shell. This version is a structured optimization based on the original exploit found at Exploit-DB (ID: 52261).
Demonstration application for CVE-2022-42889 (Apache Commons Text RCE) with Docker setup and netcat-based command execution for security testing and education.
Docker-based lab environment to reproduce and test the Text4Shell (CVE-2022-42889) remote code execution vulnerability in Apache Commons Text.
Dockerized proof-of-concept for CVE-2022-42889 (Text4Shell) with script, DNS, and URL lookup-based RCE payloads for security testing and education.
Proof-of-concept exploit for CVE-2022-42889 (Text4Shell) in Apache Commons Text, with manual and mass exploitation scripts using script, URL, and DNS lookups.
Setup and exploit recreation for CVE-2022-42889 Text4Shell.
Dockerized vulnerable Java application demonstrating CVE-2022-42889 (Text4Shell) remote code execution via Apache Commons Text string lookups, for security testing and education.
CVE-2022-42889 dockerized sample application (Apache Commons Text RCE)
python script for CVE-2022-42889
CVE-2022-42889 취약점 분석보고서
Proof of Concept for the Apache commons-text vulnerability CVE-2022-42889.
Proof of Concept Appliction for testing CVE-2022-42889
This project includes a python script which generates malicious commands leveraging CVE-2022-42889 vulnerability
CVE-2022-42889 (a.k.a. Text4Shell) RCE Proof of Concept
A custom Python-based proof-of-concept (PoC) exploit targeting Text4Shell (CVE-2022-42889), a critical remote code execution vulnerability in Apache Commons Text versions < 1.10.
An intentionally vulnerable webapp to get your hands dirty with CVE-2022-42889.
通过 jvm 启动参数 以及 jps pid进行拦截非法参数
A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228
Proof-of-concept exploit for CVE-2022-42889 (Text4Shell), demonstrating remote code execution via Apache Commons Text string substitution.
Dockerized POC for CVE-2022-42889 Text4Shell
Lightweight Java-based checker for CVE-2022-42889 (Apache Commons Text RCE). Quickly validates if a target is vulnerable to the Text4Shell remote code execution flaw.
Dockerized proof-of-concept for CVE-2022-42889 (Text4Shell) vulnerability exploitation in Apache Commons Text, enabling reproducible security testing and validation.
CVE-2022-42889 Blind-RCE Nuclei Template
exploit for CVE-2022-42889
Demonstration of CVE-2022-42889 (Text4Shell) remote code execution vulnerability in Apache Commons Text with a proof-of-concept exploit.
Log4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889
A simple application that shows how to exploit the CVE-2022-42889 vulnerability
docker for CVE-2022-42889
Proof-of-concept application demonstrating CVE-2022-42889 RCE vulnerability in Apache Commons Text 1.9 with reproducible exploit steps for security testing and education.
CVE-2022-42889 Text4Shell Exploit POC
Java library for string manipulation algorithms, packaged with a proof-of-concept exploit for CVE-2022-42889 to demonstrate and test the vulnerability.
Text4Shell
Python Script to exploit RCE of CVE-2022-42889
Proof-of-concept exploit for CVE-2022-42899, demonstrating remote code execution in Apache Commons Text 1.5-1.9 via StringSubstitutor interpolation with script:javascript payloads.
Collection of proof-of-concept exploits and technical analyses for high-impact CVEs, covering browser memory corruption, TCP/IP RCE, and web application vulnerabilities.
Proof-of-concept exploit for CVE-2022-42889 (Text4Shell), demonstrating remote code execution via Apache Commons Text string substitution.
Arjun Chaudhary · multiple · Apr 18, 2025
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.