Sploitus

Exploit for Code Injection in Apache Commons Text

CVE-2022-42889CVE-2022-42899

githubexploit · 2022-10-20

Exploit Code

README35 lines
## https://sploitus.com/exploit?id=CD3C91D4-9A28-538A-8FDE-983CDDD36949
### cve-2022-42889-intercept

* It should be noted that versions below Java11 need attention; higher versions have removed the JavaScript interpreter.
* This solution targets Java8.

Intercepts illegal parameters through JVM startup parameters and jps pid.

![rce_demo.png](rce_demo.png)

#### Quick start

```bash
-----------------------load...... cve-2022-42889 check start
cve-2022-42889 is_deep_match org.apache.commons.text.StringSubstitutor
md.getReturnType().getActualName() java.lang.String
[cve-2022-42899] Class found: class org.apache.commons.text.StringSubstitutor
(StringSubstitutor replace disabled)
[CVE 2022-42889] StringSubstitutor class org.apache Commons Text.StringSubstitutor: (sanitized) PoC Output: %_script:javascript:195 + 324_
by arksec.cn
```

### How to use

> The Java agent loaded remotely using the Attach API will no longer execute before the main method. This depends on when another virtual machine calls the Attach API. Additionally, it will no longer run in the premain method; instead, it will run in a method called agentmain. The Java Virtual Machine does not limit the number of Java agents. You can append multiple -javaagent parameters after the java command, or remotely attach multiple Java agents. The Java Virtual Machine will execute these agents one by one, in the order they are defined, or in the order of attachment.
* premain
* Java startup parameters

```bash
-javaagent:/path/to/dir/CVE-2022-42889-Agent-1.0-SNAPSHOT-jar-with-dependencies.jar
```

* agentmain
* jps (pid injection)
* Executes the main method of `Attach` (first loads `tools.jar`).