{"uuid": "ecced77e-da2e-40f0-b87d-6933e37875da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-42889", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_commons_text4shell.rb", "content": "{\"aliases\": [], \"arch\": \"java, x86, x64, cmd\", \"author\": [\"Alvaro Mu\\u00f1oz\", \"Karthik UJ\", \"Gaurav Jain\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit takes advantage of the StringSubstitutor interpolator class,\\n          which is included in the Commons Text library. A default interpolator\\n          allows for string lookups that can lead to Remote Code Execution. This\\n          is due to a logic flaw that makes the \\\"script\\\", \\\"dns\\\" and \\\"url\\\" lookup\\n          keys interpolated by default, as opposed to what it should be, according\\n          to the documentation of the StringLookupFactory class. Those keys allow\\n          an attacker to execute arbitrary code via lookups primarily using the\\n          \\\"script\\\" key.\\n\\n          In order to exploit the vulnerabilities, the following requirements must\\n          be met:\\n\\n          Run a version of Apache Commons Text from version 1.5 to 1.9\\n          Use the StringSubstitutor interpolator\\n          Target should run JDK < 15\", \"disclosure_date\": \"2022-10-13\", \"fullname\": \"exploit/multi/http/apache_commons_text4shell\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Apache Commons Text RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/apache_commons_text4shell.rb\", \"platform\": \"Java,Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/apache_commons_text4shell\", \"references\": [\"CVE-2022-42889\", \"URL-https://sysdig.com/blog/cve-2022-42889-text4shell/\", \"URL-https://github.com/karthikuj/cve-2022-42889-text4shell-docker\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Java (in-memory)\", \"Windows EXE Dropper\", \"Windows Command\", \"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:40.391724Z"}