tulhan/commons-text-goatAn intentionally vulnerable webapp to get your hands dirty with CVE-2022-42889.
This is a webapp that is intentionally vulnerable to CVE-2022-42889.
It uses an embedded Jetty server and Maven to start a servlet listening at port 8080 at URL \api. This endpoint accepts a URL parameter cmd. This is embedded between ${ and } and passed to the StringSubstitutor function; which inturn implements the StringLookupFactory.
The vulnerability exists because the StringLookupFactory includes interpolators that can be can be easily exploited if provided untrusted input. These are script, dns and . They have been disabled by default since v1.10.0 versions 1.5 and above till v1.10 are affected.
urlcoomons-textYou can run this locally by executing this command:
mvn package exec:java
Note: The program listens on
0.0.0.0by default. So, don't run this while connected to a untrusted network.