Experts warn of CVE-2022-42889 Text4Shell exploit attempts

Wordfence researchers warn of exploitation attempts targeting the recently disclosed flaw in Apache Commons Text dubbed Text4Shell.

Experts at WordPress security firm Wordfence reported exploitation attempts targeting the recently disclosed flaw in Apache Commons Text dubbed Text4Shell.

GitHub’s threat analyst Alvaro Munoz this week disclosed a remote code execution vulnerability, tracked as CVE-2022-42889 (CVSS score 9.8), in the open-source Apache Commons Text library. Apache Commons Text is a library focused on algorithms working with strings.

The vulnerability, dubbed “Text4Shell,” is an unsafe script evaluation issue caused by the interpolation system. An attacker can exploit the flaw to trigger code execution when processing malicious input in the library’s default configuration.

“The StringSubstitutor when used with the default interpolators (StringSubstitutor.createInterpolator()) will perform string lookups that may lead to arbitrary code execution.” reads the post published by Munoz. “In particular, if untrusted data flows into the StringSubstitutor.replace() or StringSubstitutor.replaceIn() methods, an attacker will be able to use the ScriptStringLookup to trigger arbitrary code execution.”

The issue was addressed with the release of Apache Commons Text 1.10.0 on on September 24, the new version disables the problematic interpolators by default.

On October 17, 2022, the Wordfence Threat Intelligence team began monitoring for activity targeting CVE-2022-42889, or “Text4Shell” on our network of 4 million websites.

Starting from October 18, 2022, Wordfence researchers started seeing activity targeting the Text4Shell vulnerability against its network of 4 million websites.

“The vast majority of requests we are seeing are using the DNS prefix and are intended to scan for vulnerable installations – a successful attempt would result in the victim site making a DNS query to the attacker-controlled listener domain.” reads the post published by Wordfence.
The script prefix is less common and is the method used to achieve actual code execution. We’ve seen a variety of payloads but all of these also appear to be intended to send a request back to a listener URL.
The url prefix is the least common one we have tracked and functions in the same way as the dns prefix.”

Wordfence researchers had observed exploitation attempts from roughly 40 IP addresses since October 18. Most of the attempts are scans likely conducted by security researchers, but some of them were likely conducted by threat actors.

Wordfence shared the list of IP addresses and listener hosts in use here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Log4Shell)

---