kosmicowl045/ict287-cve-2022-42889Setup and exploit recreation for CVE-2022-42889 Text4Shell.
To find full exploit setup and recreation report please find the CVE-2022-42889-Project Vulnerability Exploitation Report file. VM that was used to build and run the exploit isn't included in this repository.
Setup and exploit recreation for CVE-2022-42889 Text4Shell.
CVE-2022-42889, also known as "Text4Shell," was a critical vulnerability in the Apache Commons Text library, which is a library frequently used in Java applications for text processing and delivering additions to the standard Java Development Kit’s (JDK) text handling. Versions of the Apache Common Text library, dating back to 2018, 1.5 to 1.9 of the Apache common text library were reported to be affected. The vulnerability stems from unsafe input handling within the StringSubstitutor class, which enables attackers to exploit string interpolation features of the library. This can result in remote code execution (RCE) when processing maliciously crafted input, posing significant risks to applications relying on this library. Hence, CVE-2022-42889 was considered a critical vulnerability and was given a CVSS 3.x base score of 9.8, due to the severe impact it could have on affected systems, including complete system compromise.
This vulnerability has been compared to the infamous Log4Shell (CVE-2021-44228) and Spring4Shell (CVE-2022-22965) vulnerabilities due to its potential to be exploited in Java based applications. Unlike Log4Shell and Spring4Shell, which were vulnerable in even the most basic use-cases, not all users of the Apache Common Text library would be affected as the library must be used in a certain way to expose the attack surface and make the vulnerability exploitable.
The exploit demonstration utilizes cyberhack255’s Github proof of concept which provides all the scripts and tools needed to run the exploit. Below is a brief description of how the exploitation will proceed:
text4shell-poc.jar). It uses the official OpenJDK 8 runtime image based on Alpine Linux, which provides a minimal and lightweight environment. The file installs bash to enable bash scripting during the demonstration. Port 8080 is exposed to allow external access to the container while running the exploit.
This PoC will on crafting a malicious payload that exploits the string substitution mechanism in the Apache Commons Text library. The payload will target the lookup key script by invoking the StringSubstitutor.createInterpolator() method. For this demo, the payload will remotly create a new file inside of the docker.