Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2022-42889

Опубликовано: 13 окт. 2022
Источник: redhat
CVSS3: 9.8
EPSS Критический

Описание

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.

Отчет

In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:

  • Usage of specific methods that interpolate the variables as described in the flaw
  • Usage of external input for those methods
  • Usage of that external input has to be unsanitized/no "allow list"/etc. The following products have Low impact because they have maven references to the affected package but do not ship it nor use the code:
  • Red Hat EAP Expansion Pack (EAP-XP)
  • Red Hat Camel-K
  • Red Hat Camel-Quarkus Red Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.
  • The OCP has a Moderate impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.
  • The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.

Меры по смягчению последствий

This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
A-MQ Clients 2commons-textNot affected
Logging Subsystem for Red Hat OpenShiftopenshift-logging/elasticsearch6-rhel8Not affected
Red Hat A-MQ Onlinecommons-textNot affected
Red Hat build of Apicurio Registry 2commons-textNot affected
Red Hat build of Debezium 1commons-textNot affected
Red Hat Data Grid 8commons-textNot affected
Red Hat Integration Camel K 1commons-textAffected
Red Hat JBoss Data Grid 7commons-textNot affected
Red Hat JBoss Enterprise Application Platform 6commons-textNot affected
Red Hat JBoss Enterprise Application Platform 7commons-textAffected

Показывать по

Дополнительная информация

Статус:

Critical
Дефект:
CWE-94->CWE-1188
https://bugzilla.redhat.com/show_bug.cgi?id=2135435apache-commons-text: variable interpolation RCE

EPSS

Процентиль: 100%
0.94161
Критический

9.8 Critical

CVSS3

Связанные уязвимости

CVSS3: 9.8
ubuntu
около 3 лет назад

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolato...

CVSS3: 9.8
nvd
около 3 лет назад

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators

CVSS3: 9.8
debian
около 3 лет назад

Apache Commons Text performs variable interpolation, allowing properti ...

CVSS3: 9.8
github
около 3 лет назад

Arbitrary code execution in Apache Commons Text

CVSS3: 9.8
fstec
около 3 лет назад

Уязвимость компонента StringSubstitutor библиотеки Apache Common Text, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%
0.94161
Критический

9.8 Critical

CVSS3