CVE-2022-42889 — Proof-of-concept application demonstrating CVE-2022-42889 RCE vulnerability in Apache Commons Text 1.9 with reproducible exploit steps for security testing and education. | Kitploit

Share

CVE-2022-42889 Test application

This repository contains a simple application using Apache Commons Text 1.9 which is vulnerable to CVE-2022-42889.

Steps to reproduce the exploit.

Steps to reproduce the exploit in a repo.

Copy DemoApplication.java to your repo.
Run the main method, with default string (suggested).
If your output for the default string is 519. Or if your app runs without any error:
- Then the app is exploitable. 🥵

Running the application in VM

Clone the repo
Build the project

  mvn assembly:assembly -DdescriptorId=jar-with-dependencies

Run the application on VM (by giving below command)

  java -jar target/demo-0.0.1-SNAPSHOT-jar-with-dependencies.jar

When asked for input, let the default string (Hit enter).