cve-2022-42889-intercept

cve-2022-42889-intercept

• For versions below Java 11, special attention is required, as higher versions have already removed the Javascript interpreter.
• This solution targets Java 8.

Intercept illegal parameters via JVM startup parameters and jps pid.

quick start

-----------------------load......
cve-2022-42889 check start
cve-2022-42889 is_deep_match  org.apache.commons.text.StringSubstitutor
md.getReturnType().getActualName() java.lang.String
[cve-2022-42899] class found!: class org.apache.commons.text.StringSubstitutor
(StringSubstitutor replace disabled)
[CVE 2022-42889] StringSubstitutorclass org.apache.commons.text.StringSubstitutor: (sanitized) PoC Output: %_script:javascript:195 + 324_
by arksec.cn

Usage

Using the Attach API to remotely load a Java agent will no longer execute before the main method, depending on when another virtual machine invokes the Attach API. Furthermore, it no longer runs the premain method, but instead runs a method called agentmain. The Java virtual machine does not limit the number of Java agents. You can append multiple -javaagent parameters after the java command, or remotely attach multiple Java agents. The Java virtual machine will execute these Java agents in the order they are defined or attached.

• premain
• java startup parameters

-javaagent:/path/to/dir/CVE-2022-42889-Agent-1.0-SNAPSHOT-jar-with-dependencies.jar

• agentmain
• jps (pid injection)
• Execute the main method of Attach (first import tools.jar)