security.apache.org Open in urlscan Pro
2a04:4e42::644  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Apache Security Team
Apache Security Team
 * Blog
 * License
 * Sponsorship
 * Thanks
 * Privacy
 * Apache




CVE-2022-42889: INTERPOLATIONS THAT ALLOW RCE DISABLED IN COMMONS TEXT 1.10.0

> Find out if you should worry about CVE-2022-42889, which was recently released
> by the Apache Commons Text team

2 minute read Published: 18 Oct, 2022

On 2022-10-13, the Apache Commons Text team disclosed CVE-2022-42889. Key
takeaways:

 * If you rely on software that uses a version of commons-text prior to 1.10.0,
   you are likely still not vulnerable: you are only affected when this software
   uses the StringSubstitutor API without properly sanitizing any untrusted
   input.
 * If your own software uses commons-text, double-check whether it uses the
   StringSubstitutor API without properly sanitizing any untrusted input. If so,
   an update to 1.10.0 could be a quick workaround, but the recommended solution
   is to also properly validate and sanitize any untrusted input.

Apache Commons Text is a low-level library for performing various text
operations, such as escaping, calculating string differences, and substituting
placeholders in the text with values looked up through interpolators. When using
the string substitution feature, some of the available interpolators can trigger
network access or code execution. This is intended, but it also means an
application that includes user input in the string passed to the substitution
without properly sanitizing it would allow an attacker to trigger those
interpolators.

For that reason the Apache Commons Text team have decided to update the
configuration to be more “secure by default”, so that the impact of a failure to
validate inputs is mitigated and will not give an attacker access to these
interpolators. However, it is still recommended that users treat untrusted input
with care.

We’re not currently aware of any applications that pass untrusted input to the
substitutor and thus would have been impacted by this problem prior to Apache
Commons Text 1.10.0.

This issue is different from Log4Shell (CVE-2021-44228) because in Log4Shell,
string interpolation was possible from the log message body, which commonly
contains untrusted input. In the Apache Common Text issue, the relevant method
is explicitly intended and clearly documented to perform string interpolation,
so it is much less likely that applications would inadvertently pass in
untrusted input without proper validation.

Credit: this issue was reported independently by Ruilin and by @pwntester
(Alvaro Muñoz) of the GitHub Security Lab team. Thank you!

References:

 * Announcement on dev@commons.apache.org
 * Announcement on oss-security
 * Advisory on cve.org
 * GHSL advisory

Published by Arnout Engelen 18 Oct, 2022 using 348 words.

© 2023 The Apache Software Foundation. Built using the kube Theme for Hugo.
Apache and the Apache feather logo are either registered trademarks or
trademarks of The Apache Software Foundation in the United States and other
countries.