Text4Shell (CVE-2022-42889) is a critical remote code execution vulnerability in Apache Commons Text (versions 1.5–1.9) that can be triggered by crafted input strings to run code on vulnerable hosts. The advisory covers exploitation methods, potential post-exploitation impacts, and recommended mitigations including patching to 1.10.0 and maintaining asset inventories. #Text4Shell #CVE-2022-42889 #ApacheCommonsText #StringLookup #CobaltStrike #Sliver
Keypoints
- Text4Shell is a critical remote code execution flaw in Apache Commons Text versions 1.5–1.9; a patch is available in version 1.10.0.
- The vulnerability affects any applications using the Apache Commons Text library and public-facing servers are most at risk, though its scope is not expected to be as wide as Log4Shell or Spring4Shell.
- Exploitation relies on manipulating input prefixes (e.g., URL parameters) to trigger StringLookup evaluation and run code on the host; the attack can be carried out by passing a prefix string in the URL to the vulnerable app. “The attack is not complex and can be carried out simply by passing a prefix string where the prefix is a query which can be fed in via a parameter into the URL of the vulnerable application.”
- Payloads can be delivered via different prefixes, such as script or dns, allowing execution of JavaScript and subsequent shell commands on the host. “The prefix ‘script’ will execute a JavaScript payload which will then run a shell command on the host.”
- Evidence of successful exploitation can include created files like /tmp/whoami.txt containing “root,” indicating remote code execution.
- Post-exploitation scenarios include adding a new user, downloading a webshell or C2 framework beacons (e.g., Cobalt Strike, Sliver) depending on permissions.
- Securonix recommends asset inventory, patching to 1.10.0, and using specific detection queries and policies to identify exploitation attempts.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Text4Shell works by manipulating input… ‘The attack is not complex and can be carried out simply by passing a prefix string where the prefix is a query which can be fed in via a parameter into the URL of the vulnerable application.’
- [T1059.004] Unix Shell – The payload can run a shell command on the host; ‘which will then run a shell command on the host.’
- [T1059.007] JavaScript – The exploit uses a JavaScript payload via the script prefix; ‘to execute a JavaScript payload which will then run a shell command on the host.’
- [T1105] Ingress Tool Transfer – The attacker could download a webshell or C2 beacon onto the host after initial access; ‘downloading a webshell from a remote C2 server, or downloading and executing a C2 framework beacon such as Cobalt Strike or Sliver.’
Indicators of Compromise
- [URL/URI] Exploit attempt patterns – ${script, ${dns, ${url, and their URL-encoded variants like %24%7Bscript, %24%7Bdns;
- [File] Post-exploitation artifact – /tmp/whoami.txt created with content “root”.
- [Code/Request Content] Observed presence of java.lang.Runtime in requests – used as an indicator in detections.
Read more: https://www.securonix.com/blog/apache-commons-text4shell/