Security researchers from Wordfence, the WordPress security plugin, have announced that a new critical zero-day vulnerability in the Apache Commons Text Library is being actively exploited in-the-wild by threat actors. The Apache Commons Text Library is a low-level addition to the Java Development Kit’s (JDK) text handling, performing operations like calculating string differences, escaping, and substituting placeholders in text. The vulnerability has been coined “Text4Shell” (tracked as CVE 2022-42889) and results from insecure defaults when the library performs variable interpolation, which is the process of identifying the value of strings in code sets that contain placeholders. The flaw affects users who have direct dependencies on Apache Commons Text in their web applications that are using the string substitution feature and allowing the function to accept user inputs. A threat actor could exploit this vulnerability to set up a reverse shell with the vulnerable application via a maliciously crafted DNS or URL query payload. If successfully exploited, victims could unknowingly make a DNS query to the attacker-controlled domain at the other end of the reverse shell, potentially allowing the threat actors to breach the victim network and perform devastating follow-on attacks like remote code execution (RCE).
The flaw has been compared by some to notorious flaws like “Log4Shell” and “Spring4Shell”, receiving a severe CVSS score of 9.8/10; however, many researchers have stated that this vulnerability is nowhere near as dangerous. Tenable senior research engineer Claire Tills stated that while the vulnerability has a very high CVSS score, it appears to require very specific application development practices and configurations that are uncommon. This was corroborated from vulnerability researchers in other notable organizations like Sophos, Contrast Security, Jfrog Security, and GreyNoise agreeing that this flaw is far less severe. The exploitation attempts found in the wild appear to only be scanning for the vulnerability itself. WordFence has stated that said that customers using Java version 15 and later should be safe from code execution since script interpolation is not possible. However, the DNS and URL vectors for exploiting the flaw would still work. ASF has patched this vulnerability and released an updated version of Apache Commons Text (1.10.0), and users with direct dependencies are urged to update their software to prevent exploitation. Regardless of whether this vulnerability is as severe as the CVSS score suggests or is overhyped, it is another indicator that the potential security risks stemming from open-source third-party dependencies pose a risk to web applications and their networks. CTIX analysts will continue to monitor this flaw and will provide an update with more clarity on the severity when it becomes known.