Text4Shell
- Product
- Apache Commons Text
- CVE
- CVE-2022-42889
- Disclosed
- 2022-10-13
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- 1.5 through 1.9
- Fixed
- 1.10.0
Summary
Apache Commons Text's StringSubstitutor interpolates ${prefix:value} lookups, and its default set included 'script', 'dns' and 'url' lookups. Applications that pass untrusted input to the default interpolator let attackers run code through the JVM script engine. It was named after Log4Shell but is far less exposed, since apps must interpolate attacker input themselves.
Root cause
StringSubstitutor.createInterpolator() enabled ScriptStringLookup by default, which evaluates ${script:<engine>:<code>} with javax.script (e.g. Nashorn JavaScript on JDK 8-14). Any code path that calls replace() on attacker-controlled text therefore becomes a code-evaluation sink. 1.10.0 removed script, dns and url from the default lookups.
Impact
Remote code execution in applications that run user input through Commons Text's default interpolator; reachability depends heavily on application code.
Public PoC
# Harmless test string for an input that reaches StringSubstitutor.replace():
${script:javascript:1+1}Source: GitHub Security Lab advisory GHSL-2022-018
Detection
Grep logs and request data for ${script:, ${dns: and ${url:. Find commons-text 1.5-1.9 in dependency trees (SCA). Nuclei template CVE-2022-42889.
Mitigation
Upgrade to commons-text 1.10.0+ and avoid passing untrusted input to StringSubstitutor.createInterpolator().