9.8

CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

Modified
AliasesRHSA-2023:1524UBUNTU-CVE-2022-42889DEBIAN-CVE-2022-42889
Published 13-10-2022Last modified 20-11-2024

Vulnerability summary

CVE-2022-42889 is a critical (CVSS 9.8) Improper Control of Generation of Code vulnerability in apache software foundation apache commons text. EPSS estimates a 99.93% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 13-10-2022)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
99.93%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 16
RHSA-2023:0261RHSA-2023:1655RHSA-2023:2097RHSA-2023:3195RHSA-2023:3198RHSA-2023:3299

Timeline

  1. 13-10-2022
    PublishedVulnerability first disclosed.
  2. 20-11-2024
    Last modifiedVulnerability information updated.

Description

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

99.93%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 99.93% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • exploit-databasemultipleUnverified

    Apache Commons Text 1.10.0 - Remote Code Execution

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Apache Commons Text RCE

    exploit/multi/http/apache_commons_text4shell

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Apache1 product
Apache software foundation1 product
Com.guicedee.services1 product
  • commons-text≤ 1.2.2.1-jre17
Debian1 product
  • commons-text< 1.10.0-1
Juniper1 product
Netapp1 product
Opensuse1 product
  • apache-commons-text&distro=openSUSE Tumbleweed< 1.10.0-1.1
Org.apache.commons1 product
  • commons-text≥ 1.5, < 1.10.0
Redhat1 product
  • jenkins-2-plugins< 0:4.9.1680069756-1.el8
Ubuntu1 product
  • commons-textAll versions (No fix recorded)

10 vendors · 10 products

References

27 links
Show all 27 references