# CVE-2022-42889: Arbitrary code execution in Apache Commons Text

> CVE-2022-42889 (GitHub advisory GHSA-599f-7c49-w659) is a critical-severity vulnerability with a CVSS 3.1 base score of 9.8, classed as Improper Control of Generation of Code ('Code Injection') (CWE-94), in org.apache.commons:commons-text (Maven) and com.guicedee.services:commons-text (Maven). It is fixed in 1.10.0.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2022-42889

| Field | Value |
| --- | --- |
| CVE | CVE-2022-42889 |
| GHSA | GHSA-599f-7c49-w659 |
| Severity | Critical |
| CVSS 3.1 | 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-94 Improper Control of Generation of Code ('Code Injection') |
| EPSS | 99.93% (higher than 99.9% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable yes, technical impact total |
| Published | 13 Oct 2022 |
| Modified | 20 Nov 2024 |

## Description

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.apache.commons:commons-text | Maven | `pkg:maven/org.apache.commons/commons-text` | >= 1.5, < 1.10.0 | 1.10.0 |
| com.guicedee.services:commons-text | Maven | `pkg:maven/com.guicedee.services/commons-text` | <= 1.2.2.1-jre17 | no fix |

## Fix commits

- Release: https://github.com/apache/commons-text/commit/9397c1cdce7e78ffb3f53267d47c857d54c45d1c (1.10.0)

## Questions

**What is the GHSA ID for CVE-2022-42889?**

GitHub tracks CVE-2022-42889 as GHSA-599f-7c49-w659.

**What is the CVSS score of CVE-2022-42889?**

CVE-2022-42889 has a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

**Which versions are affected by CVE-2022-42889?**

org.apache.commons:commons-text (Maven): >= 1.5, < 1.10.0. com.guicedee.services:commons-text (Maven): <= 1.2.2.1-jre17.

**How do I fix CVE-2022-42889?**

Upgrade to 1.10.0 or later.

**What is the Package URL (PURL) for CVE-2022-42889?**

The affected packages' PURLs are pkg:maven/org.apache.commons/commons-text and pkg:maven/com.guicedee.services/commons-text.

**Is CVE-2022-42889 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2022-42889. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 99.93% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2022-42889 (advisory)
- https://security.gentoo.org/glsa/202301-05 (advisory)
- https://security.netapp.com/advisory/ntap-20221020-0004 (advisory)
- https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42889.json (advisory)
- https://github.com/advisories/GHSA-599f-7c49-w659 (advisory)
- http://seclists.org/fulldisclosure/2023/Feb/3 (article)
- http://www.openwall.com/lists/oss-security/2022/10/13/4 (article)
- http://www.openwall.com/lists/oss-security/2022/10/18/1 (article)
- https://github.com/apache/commons-text (package)
- https://arxiv.org/pdf/2306.05534
- https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
- http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
- http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2022-42889), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.