Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2022-42889 PoC — Apache Commons Text 代码注入漏洞

Source
Associated Vulnerability
Title:Apache Commons Text 代码注入漏洞 (CVE-2022-42889)
Description:Apache Commons Text是美国阿帕奇(Apache)基金会的一个专注于字符串算法的库。 Apache Commons Text 1.5至1.9版本存在安全漏洞,该漏洞源于默认的Lookup实例集包括可能导致任意代码执行或与远程服务器联系的插值器,可能容易受到远程代码执行或与远程服务器的无意接触的影响。
Readme
<!---
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
 this work for additional information regarding copyright ownership.
 The ASF licenses this file to You under the Apache License, Version 2.0
 (the "License"); you may not use this file except in compliance with
 the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-->
<!---
 +======================================================================+
 |****                                                              ****|
 |****      THIS FILE IS GENERATED BY THE COMMONS BUILD PLUGIN      ****|
 |****                    DO NOT EDIT DIRECTLY                      ****|
 |****                                                              ****|
 +======================================================================+
 | TEMPLATE FILE: readme-md-template.md                                 |
 | commons-build-plugin/trunk/src/main/resources/commons-xdoc-templates |
 +======================================================================+
 |                                                                      |
 | 1) Re-generate using: mvn commons-build:readme-md                    |
 |                                                                      |
 | 2) Set the following properties in the component's pom:              |
 |    - commons.componentid (required, alphabetic, lower case)          |
 |    - commons.release.version (required)                              |
 |                                                                      |
 | 3) Example Properties                                                |
 |                                                                      |
 |  <properties>                                                        |
 |    <commons.componentid>math</commons.componentid>                   |
 |    <commons.release.version>1.2</commons.release.version>            |
 |  </properties>                                                       |
 |                                                                      |
 +======================================================================+
--->
Apache Commons Text
===================

[![Build Status](https://travis-ci.org/apache/commons-text.svg)](https://travis-ci.org/apache/commons-text)
[![Coverage Status](https://coveralls.io/repos/apache/commons-text/badge.svg)](https://coveralls.io/r/apache/commons-text)
[![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.apache.commons/commons-text/badge.svg)](https://maven-badges.herokuapp.com/maven-central/org.apache.commons/commons-text/)
[![Javadocs](https://javadoc.io/badge/org.apache.commons/commons-text/1.9.svg)](https://javadoc.io/doc/org.apache.commons/commons-text/1.9)

Apache Commons Text is a library focused on algorithms working on strings.

Documentation
-------------

More information can be found on the [Apache Commons Text homepage](https://commons.apache.org/proper/commons-text).
The [Javadoc](https://commons.apache.org/proper/commons-text/apidocs) can be browsed.
Questions related to the usage of Apache Commons Text should be posted to the [user mailing list][ml].

Where can I get the latest release?
-----------------------------------
You can download source and binaries from our [download page](https://commons.apache.org/proper/commons-text/download_text.cgi).

Alternatively you can pull it from the central Maven repositories:

```xml
<dependency>
  <groupId>org.apache.commons</groupId>
  <artifactId>commons-text</artifactId>
  <version>1.9</version>
</dependency>
```

Contributing
------------

We accept Pull Requests via GitHub. The [developer mailing list][ml] is the main channel of communication for contributors.
There are some guidelines which will make applying PRs easier for us:
+ No tabs! Please use spaces for indentation.
+ Respect the code style.
+ Create minimal diffs - disable on save actions like reformat source code or organize imports. If you feel the source code should be reformatted create a separate PR for this change.
+ Provide JUnit tests for your changes and make sure your changes don't break any existing tests by running ```mvn clean test```.

If you plan to contribute on a regular basis, please consider filing a [contributor license agreement](https://www.apache.org/licenses/#clas).
You can learn more about contributing via GitHub in our [contribution guidelines](CONTRIBUTING.md).

License
-------
This code is under the [Apache Licence v2](https://www.apache.org/licenses/LICENSE-2.0).

See the `NOTICE.txt` file for required notices and attributions.

Donations
---------
You like Apache Commons Text? Then [donate back to the ASF](https://www.apache.org/foundation/contributing.html) to support the development.

Additional Resources
--------------------

+ [Apache Commons Homepage](https://commons.apache.org/)
+ [Apache Issue Tracker (JIRA)](https://issues.apache.org/jira/browse/TEXT)
+ [Apache Commons Twitter Account](https://twitter.com/ApacheCommons)
+ `#apache-commons` IRC channel on `irc.freenode.org`

[ml]:https://commons.apache.org/mail-lists.html
File Snapshot

[4.0K] /data/pocs/b6e5395d1d196c27d23fbe11ea592bae0cbb23a9 ├── [2.8K] checkstyle-suppressions.xml ├── [7.5K] checkstyle.xml ├── [6.4K] CONTRIBUTING.md ├── [ 802] license-header.txt ├── [ 11K] LICENSE.txt ├── [ 174] NOTICE.txt ├── [ 16K] pom.xml ├── [5.4K] README.md ├── [ 22K] RELEASE-NOTES.txt ├── [1.2K] sb-excludes.xml └── [4.0K] src ├── [4.0K] assembly │   ├── [1.5K] bin.xml │   └── [1.7K] src.xml ├── [4.0K] changes │   ├── [ 25K] changes.xml │   └── [4.4K] release-notes.vm ├── [4.0K] main │   └── [4.0K] java │   └── [4.0K] org │   └── [4.0K] apache │   └── [4.0K] commons │   └── [4.0K] text │   ├── [ 19K] AlphabetConverter.java │   ├── [2.9K] Builder.java │   ├── [5.5K] CaseUtils.java │   ├── [1.3K] CharacterPredicate.java │   ├── [3.1K] CharacterPredicates.java │   ├── [3.6K] CompositeFormat.java │   ├── [4.0K] diff │   │   ├── [4.2K] CommandVisitor.java │   │   ├── [2.0K] DeleteCommand.java │   │   ├── [3.3K] EditCommand.java │   │   ├── [4.2K] EditScript.java │   │   ├── [2.0K] InsertCommand.java │   │   ├── [2.1K] KeepCommand.java │   │   ├── [1.0K] package-info.java │   │   ├── [4.2K] ReplacementsFinder.java │   │   ├── [2.2K] ReplacementsHandler.java │   │   └── [ 11K] StringsComparator.java │   ├── [ 20K] ExtendedMessageFormat.java │   ├── [1.4K] FormatFactory.java │   ├── [6.6K] FormattableUtils.java │   ├── [4.0K] io │   │   ├── [1.3K] package-info.java │   │   └── [ 12K] StringSubstitutorReader.java │   ├── [4.0K] lookup │   │   ├── [2.9K] AbstractStringLookup.java │   │   ├── [3.4K] BiFunctionStringLookup.java │   │   ├── [2.8K] BiStringLookup.java │   │   ├── [5.8K] ConstantStringLookup.java │   │   ├── [3.1K] DateStringLookup.java │   │   ├── [5.6K] DefaultStringLookup.java │   │   ├── [3.4K] DnsStringLookup.java │   │   ├── [2.9K] FileStringLookup.java │   │   ├── [3.1K] FunctionStringLookup.java │   │   ├── [2.3K] IllegalArgumentExceptions.java │   │   ├── [1.4K] InetAddressKeys.java │   │   ├── [5.4K] InterpolatorStringLookup.java │   │   ├── [8.1K] JavaPlatformStringLookup.java │   │   ├── [2.5K] LocalHostStringLookup.java │   │   ├── [1.8K] package-info.java │   │   ├── [3.3K] PropertiesStringLookup.java │   │   ├── [4.0K] ResourceBundleStringLookup.java │   │   ├── [3.0K] ScriptStringLookup.java │   │   ├── [ 35K] StringLookupFactory.java │   │   ├── [2.4K] StringLookup.java │   │   ├── [2.0K] UrlDecoderStringLookup.java │   │   ├── [2.0K] UrlEncoderStringLookup.java │   │   ├── [3.0K] UrlStringLookup.java │   │   └── [2.7K] XmlStringLookup.java │   ├── [4.0K] matcher │   │   ├── [ 14K] AbstractStringMatcher.java │   │   ├── [1.1K] package-info.java │   │   ├── [7.7K] StringMatcherFactory.java │   │   └── [6.9K] StringMatcher.java │   ├── [ 904] package-info.java │   ├── [ 17K] RandomStringGenerator.java │   ├── [4.0K] similarity │   │   ├── [2.2K] CosineDistance.java │   │   ├── [3.6K] CosineSimilarity.java │   │   ├── [2.1K] Counter.java │   │   ├── [3.5K] EditDistanceFrom.java │   │   ├── [2.2K] EditDistance.java │   │   ├── [5.2K] FuzzyScore.java │   │   ├── [2.8K] HammingDistance.java │   │   ├── [3.5K] IntersectionResult.java │   │   ├── [8.2K] IntersectionSimilarity.java │   │   ├── [2.1K] JaccardDistance.java │   │   ├── [3.1K] JaccardSimilarity.java │   │   ├── [6.0K] JaroWinklerDistance.java │   │   ├── [5.9K] JaroWinklerSimilarity.java │   │   ├── [ 20K] LevenshteinDetailedDistance.java │   │   ├── [ 14K] LevenshteinDistance.java │   │   ├── [3.8K] LevenshteinResults.java │   │   ├── [2.5K] LongestCommonSubsequenceDistance.java │   │   ├── [7.4K] LongestCommonSubsequence.java │   │   ├── [2.3K] package-info.java │   │   ├── [1.9K] RegexTokenizer.java │   │   ├── [3.6K] SimilarityScoreFrom.java │   │   ├── [2.2K] SimilarityScore.java │   │   └── [1.1K] Tokenizer.java │   ├── [103K] StrBuilder.java │   ├── [ 34K] StringEscapeUtils.java │   ├── [ 59K] StringSubstitutor.java │   ├── [ 39K] StringTokenizer.java │   ├── [7.3K] StrLookup.java │   ├── [ 15K] StrMatcher.java │   ├── [ 52K] StrSubstitutor.java │   ├── [ 38K] StrTokenizer.java │   ├── [1.9K] TextRandomProvider.java │   ├── [106K] TextStringBuilder.java │   ├── [4.0K] translate │   │   ├── [2.3K] AggregateTranslator.java │   │   ├── [5.6K] CharSequenceTranslator.java │   │   ├── [1.9K] CodePointTranslator.java │   │   ├── [3.6K] CsvTranslators.java │   │   ├── [ 29K] EntityArrays.java │   │   ├── [3.9K] JavaUnicodeEscaper.java │   │   ├── [3.7K] LookupTranslator.java │   │   ├── [4.2K] NumericEntityEscaper.java │   │   ├── [5.1K] NumericEntityUnescaper.java │   │   ├── [3.1K] OctalUnescaper.java │   │   ├── [1.1K] package-info.java │   │   ├── [2.3K] SinglePassTranslator.java │   │   ├── [4.8K] UnicodeEscaper.java │   │   ├── [2.5K] UnicodeUnescaper.java │   │   └── [1.5K] UnicodeUnpairedSurrogateRemover.java │   └── [ 36K] WordUtils.java ├── [4.0K] media │   └── [ 17K] logo.xcf ├── [4.0K] site │   ├── [4.0K] resources │   │   ├── [ 157] download_text.cgi │   │   ├── [4.0K] images │   │   │   └── [9.9K] logo.png │   │   ├── [ 0] profile.jacoco │   │   └── [ 18K] RELEASE-NOTES.txt │   ├── [1.9K] site.xml │   └── [4.0K] xdoc │   ├── [6.8K] developerguide.xml │   ├── [7.9K] download_text.xml │   ├── [4.4K] index.xml │   ├── [5.7K] issue-tracking.xml │   ├── [9.3K] mail-lists.xml │   ├── [3.0K] proposal.xml │   └── [ 12K] userguide.xml └── [4.0K] test ├── [4.0K] java │   └── [4.0K] org │   └── [4.0K] apache │   └── [4.0K] commons │   └── [4.0K] text │   ├── [ 14K] AlphabetConverterTest.java │   ├── [4.2K] CaseUtilsTest.java │   ├── [5.3K] CharacterPredicatesTest.java │   ├── [3.1K] CompositeFormatTest.java │   ├── [4.0K] diff │   │   ├── [3.5K] ReplacementsFinderTest.java │   │   └── [3.7K] StringsComparatorTest.java │   ├── [ 25K] ExtendedMessageFormatTest.java │   ├── [ 10K] FormattableUtilsTest.java │   ├── [4.0K] io │   │   └── [ 13K] StringSubstitutorFilterReaderTest.java │   ├── [4.0K] lookup │   │   ├── [1.9K] AbstractStringLookupTest.java │   │   ├── [1.5K] Base64DecoderStringLookupTest.java │   │   ├── [1.5K] Base64EncoderStringLookupTest.java │   │   ├── [4.0K] BiFunctionStringLookupTest.java │   │   ├── [1.2K] BiStringLookupTest.java │   │   ├── [2.8K] ConstantStringLookupBasicTest.java │   │   ├── [4.6K] ConstantStringLookupTest.java │   │   ├── [2.3K] DateStringLookupTest.java │   │   ├── [3.7K] DefaultStringLookupTest.java │   │   ├── [3.1K] DnsStringLookupTest.java │   │   ├── [1.9K] EnvironmentVariableStringLookupTest.java │   │   ├── [2.5K] FileStringLookupTest.java │   │   ├── [2.0K] FunctionStringLookupTest.java │   │   ├── [4.4K] InterpolatorStringLookupTest.java │   │   ├── [1.9K] JavaPlatformStringLookupTest.java │   │   ├── [2.2K] LocalHostStringLookupTest.java │   │   ├── [1.4K] NullStringLookupTest.java │   │   ├── [4.5K] PropertiesStringLookupTest.java │   │   ├── [3.6K] ResourceBundleStringLookupTest.java │   │   ├── [1.8K] ScriptEngineFactoryHelper.java │   │   ├── [2.7K] ScriptStringLookupTest.java │   │   ├── [5.6K] StringLookupFactoryTest.java │   │   ├── [1.6K] SystemPropertyStringLookupTest.java │   │   ├── [2.4K] UrlDecoderStringLookupTest.java │   │   ├── [2.1K] UrlEncoderStringLookupTest.java │   │   ├── [3.0K] UrlStringLookupTest.java │   │   └── [1.9K] XmlStringLookupTest.java │   ├── [4.0K] matcher │   │   ├── [6.8K] StringMatcherFactoryTest.java │   │   ├── [ 18K] StringMatcherOnCharArrayTest.java │   │   ├── [ 18K] StringMatcherOnCharSequenceStringTest.java │   │   └── [4.3K] StringSubstitutorGetSetTest.java │   ├── [9.9K] RandomStringGeneratorTest.java │   ├── [4.0K] similarity │   │   ├── [2.4K] CosineDistanceTest.java │   │   ├── [2.6K] CosineSimilarityTest.java │   │   ├── [2.8K] FuzzyScoreTest.java │   │   ├── [2.2K] HammingDistanceTest.java │   │   ├── [5.8K] IntersectionResultTest.java │   │   ├── [ 16K] IntersectionSimilarityTest.java │   │   ├── [3.1K] JaccardDistanceTest.java │   │   ├── [3.1K] JaccardSimilarityTest.java │   │   ├── [4.3K] JaroWinklerDistanceTest.java │   │   ├── [4.2K] JaroWinklerSimilarityTest.java │   │   ├── [ 22K] LevenshteinDetailedDistanceTest.java │   │   ├── [6.9K] LevenshteinDistanceTest.java │   │   ├── [2.8K] LevenshteinResultsTest.java │   │   ├── [2.9K] LongestCommonSubsequenceDistanceTest.java │   │   ├── [6.8K] LongestCommonSubsequenceTest.java │   │   ├── [2.6K] ParameterizedEditDistanceFromTest.java │   │   ├── [4.0K] ParameterizedLevenshteinDistanceTest.java │   │   ├── [2.3K] ParameterizedSimilarityScoreFromTest.java │   │   ├── [1.6K] SimilarityScoreFromTest.java │   │   └── [2.5K] StringMetricFromTest.java │   ├── [ 50K] StrBuilderAppendInsertTest.java │   ├── [ 73K] StrBuilderTest.java │   ├── [ 27K] StringEscapeUtilsTest.java │   ├── [ 39K] StringSubstitutorTest.java │   ├── [ 11K] StringSubstitutorWithInterpolatorStringLookupTest.java │   ├── [ 34K] StringTokenizerTest.java │   ├── [5.1K] StrLookupTest.java │   ├── [ 10K] StrMatcherTest.java │   ├── [ 30K] StrSubstitutorTest.java │   ├── [ 33K] StrTokenizerTest.java │   ├── [ 44K] TextStringBuilderAppendInsertTest.java │   ├── [ 84K] TextStringBuilderTest.java │   ├── [4.0K] translate │   │   ├── [2.8K] AggregateTranslatorTest.java │   │   ├── [1.6K] CodePointTranslatorTest.java │   │   ├── [5.3K] CsvTranslatorsTest.java │   │   ├── [5.0K] EntityArraysTest.java │   │   ├── [2.6K] JavaUnicodeEscaperTest.java │   │   ├── [2.6K] LookupTranslatorTest.java │   │   ├── [2.4K] NumericEntityEscaperTest.java │   │   ├── [4.0K] NumericEntityUnescaperTest.java │   │   ├── [3.3K] OctalUnescaperTest.java │   │   ├── [2.2K] SinglePassTranslatorTest.java │   │   ├── [2.0K] UnicodeEscaperTest.java │   │   ├── [1.9K] UnicodeUnescaperTest.java │   │   └── [1.8K] UnicodeUnpairedSurrogateRemoverTest.java │   └── [ 29K] WordUtilsTest.java └── [4.0K] resources ├── [ 804] document.properties ├── [ 934] document.xml ├── [4.0K] org │   └── [4.0K] example │   └── [ 875] testResourceBundleLookup.properties └── [5.9K] stringEscapeUtilsTestData.txt 35 directories, 218 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.