CVE-2022-42889 PoC — Apache Commons Text 代码注入漏洞

Source

https://github.com/smileostrich/Text4Shell-Scanner

Associated Vulnerability

Title:Apache Commons Text 代码注入漏洞 (CVE-2022-42889)
Description:Apache Commons Text是美国阿帕奇（Apache）基金会的一个专注于字符串算法的库。 Apache Commons Text 1.5至1.9版本存在安全漏洞，该漏洞源于默认的Lookup实例集包括可能导致任意代码执行或与远程服务器联系的插值器，可能容易受到远程代码执行或与远程服务器的无意接触的影响。

Description

Vulnerability Scanner for CVE-2022-42889 (Text4Shell)

Readme

# Scanner for CVE-2022-42889 (Text4Shell)

## Description
This is a scanner for CVE-2022-42889 (Text4Shell) vulnerability

## Usage
### Step
1. Download jar file (jar file is on `preparedJar/text4shell-scanner.jar`)
2. Check java version on your system
3. Run jar file with args (refer to the following example)

### Sample command
```cmd
> java -jar text4shell-scanner.jar /Path/you/want/to/scan
```

Sample Result
```
Scanner for CVE-2022-42889
User Name : ian
OS Name : Mac OS X
Target paths : [/Users]
Exclude paths : [/.Trash, /Dropbox, /Library]

Critical! Found vulnerability(CVE-2022-42889)! Path : /Path/~~/org.apache.commons/commons-text/1.9/~~/commons-text-1.9.jar, Version : 1.9
Critical! Found vulnerability(CVE-2022-42889)! Path : /Path/~~/org.apache.commons/commons-text/1.9/~~/commons-text-1.9-sources.jar, Version : 1.9

### Result ###
Vulnerable Files are 2 exists
```

### Args
- `--charset`
- `--exclude-prefix`
- `--exclude-pattern`
- `--help`

## Environment
JDK - OpenJDK 11.0.12

## CheckList
- OS
  - [x] Mac
  - [x] Linux
  - [ ] Windows(Not supported)

## License
MIT License

File Snapshot


 [4.0K]  /data/pocs/acefb1cc62b69535ce424630942e112629fec29a
├── [ 664]  build.gradle
├── [ 138]  Dockerfile
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 59K]  gradle-wrapper.jar
│       └── [ 202]  gradle-wrapper.properties
├── [8.0K]  gradlew
├── [2.8K]  gradlew.bat
├── [1.1K]  LICENSE
├── [4.0K]  preparedJar
│   └── [1.1M]  text4shell-scanner.jar
├── [1.1K]  README.md
├── [  32]  settings.gradle
└── [4.0K]  src
    ├── [4.0K]  main
    │   └── [4.0K]  java
    │       └── [4.0K]  com
    │           └── [4.0K]  vulcheck
    │               └── [4.0K]  text4shell
    │                   ├── [4.0K]  entity
    │                   │   ├── [ 766]  Version.java
    │                   │   └── [ 252]  VulState.java
    │                   ├── [4.0K]  scanner
    │                   │   ├── [3.8K]  Config.java
    │                   │   ├── [6.5K]  Detector.java
    │                   │   └── [4.1K]  Scanner.java
    │                   └── [4.0K]  utils
    │                       ├── [ 596]  CustomUtils.java
    │                       ├── [1.2K]  DummyInputStream.java
    │                       └── [2.3K]  ZipFileParser.java
    └── [4.0K]  test
        └── [4.0K]  java
            └── [4.0K]  com
                └── [4.0K]  vulcheck
                    └── [4.0K]  text4shell
                        └── [ 405]  Text4ShellScannerTests.java

17 directories, 19 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!