Text4Shell, a remote code execution bug in Apache Commons Text library

Researcher discovered a remote code execution vulnerability in the open-source Apache Commons Text library.

GitHub’s threat analyst Alvaro Munoz discovered a remote code execution vulnerability, tracked as CVE-2022-42889, in the open-source Apache Commons Text library. Apache Commons Text is a library focused on algorithms working on strings.

The vulnerability, dubbed “Text4Shell,” is an unsafe script evaluation issue caused by the interpolation system. An attacker can exploit the flaw to trigger code execution when processing malicious input in the library’s default configuration.

“The StringSubstitutor when used with the default interpolators (StringSubstitutor.createInterpolator()) will perform string lookups that may lead to arbitrary code execution.” reads the post published by Munoz. “In particular, if untrusted data flows into the StringSubstitutor.replace() or StringSubstitutor.replaceIn() methods, an attacker will be able to use the ScriptStringLookup to trigger arbitrary code execution.”

The Apache Commons Text relies on the interpolation system to manipulate strings.

The developer Gary D. Gregory reported that starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers.

“These lookups are: – “script” – execute expressions using the JVM script execution engine (javax.script) – “dns” – resolve dns records – “url” – load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used.” wrote the developer in the Apache mailing list.

The issue was addressed with the release of Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Some experts compared to Log4Shell since it is an open-source library-level vulnerability that is likely to impact a wide variety of software applications that use the relevant object. However, initial analysis indicates that this is a bad comparison. The nature of the vulnerability means that unlike Log4Shell, it will be rare that an application uses the vulnerable component of Commons Text to process untrusted, potentially malicious input.

The vulnerability has been compared Text4Shell to Log4Shell due to its potential impact on a large number of applications that uses the library. However Rapid7 researchers downplayed the impact of the flaw in the wild.

“The vulnerability has been compared to Log4Shell since it is an open-source library-level vulnerability that is likely to impact a wide variety of software applications that use the relevant object. However, initial analysis indicates that this is a bad comparison.” reads the post published by Rapid7. “The nature of the vulnerability means that unlike Log4Shell, it will be rare that an application uses the vulnerable component of Commons Text to process untrusted, potentially malicious input.”

Apache’s security team also confirmed that the issue is not comparable with Log4Shell.

“This issue is different from Log4Shell (CVE-2021-44228) because in Log4Shell, string interpolation was possible from the log message body, which commonly contains untrusted input. In the Apache Common Text issue, the relevant method is explicitly intended and clearly documented to perform string interpolation, so it is much less likely that applications would inadvertently pass in untrusted input without proper validation.” wrote the security team.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Text4Shell)