# CVE-2022-42889 (Text4Shell) Testing Script
This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889.
## About Text4Shell (CVE-2022-42889)
- **Exploitation requirements**:
- The application accepts user-controlled input that is subsequently processed by one of the following methods of the affected component:
- Java versions equal or greater than Java 15 would not be susceptible to remote code execution, since the Nashorn engine is disabled and the “script” prefix would not be available. However, other attacks via the “url” and “dns” prefixes would be possible.
## Script Usage
This Python script helps in testing the presence of the Text4Shell vulnerability in a system. The scope of this script includes: testing of script and url prefixes.
The script has two modes of operation: RCE and SSRF, controlled by the `-m` or `--mode` command-line argument. It constructs a URL incorporating a crafted string based on the selected mode and makes a GET request to the URL.
### RCE Mode
python text4shell.py -u 'http://example.com/search?query=' -c 'your_command' -m 'rce'
### SSRF Mode
In SSRF mode, the script creates a crafted string that includes a URL fetch command.
python text4shell.py -u 'http://example.com/search?query=' -m 'ssrf' -s 'http://example.com/resource'
The script makes a GET request to the constructed URL and prints the HTTP response status code and body.