CVE-2022-42889: Text4Shell
A remote code execution vulnerability in Apache Commons Text's default string interpolation feature. When an application passes untrusted input through StringSubstitutor with the library's default set of lookups enabled, the attacker can trigger the script, dns, or url lookups to run arbitrary script code, perform DNS lookups, or fetch remote content, similar in shape to Log4Shell but scoped to applications that echo user input through this specific API.
View the authoritative record on NVD ↗Affected software
- Apache Commons Text 1.5 through 1.9
How it's exploited
Submit a string such as ${script:javascript:...} to an application that passes untrusted input to StringSubstitutor.replace() with Commons Text's default interpolator lookups enabled; the script lookup evaluates the embedded expression, executing attacker-controlled code.
Severity
CVE-2022-42889 carries a CVSS 3.1 base score of 9.8, rated Critical. See how CVSS scoring works or score a vulnerability yourself with the free CVSS calculator.
Weakness type
CVE-2022-42889 is categorized under CWE-94, the general weakness pattern behind this specific vulnerability.
How TurboPentest tests for this (white-box)
This weakness (Code Injection) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 6 rules for it, flagging the issue directly in your source code as part of the pentest.
Remediation
Upgrade to Apache Commons Text 1.10.0 or later, which disables the dangerous script, dns, and url interpolators by default; if upgrading is not immediately possible, avoid passing untrusted input into StringSubstitutor with default lookups enabled.
Frequently asked questions
What is CVE-2022-42889?
A remote code execution vulnerability in Apache Commons Text's default string interpolation feature. When an application passes untrusted input through StringSubstitutor with the library's default set of lookups enabled, the attacker can trigger the script, dns, or url lookups to run arbitrary script code, perform DNS lookups, or fetch remote content, similar in shape to Log4Shell but scoped to applications that echo user input through this specific API.
How severe is CVE-2022-42889?
CVE-2022-42889 has a CVSS 3.1 base score of 9.8 out of 10, rated Critical.
What software is affected by CVE-2022-42889?
CVE-2022-42889 affects Apache Commons Text 1.5 through 1.9.
How do you fix CVE-2022-42889?
Upgrade to Apache Commons Text 1.10.0 or later, which disables the dangerous script, dns, and url interpolators by default; if upgrading is not immediately possible, avoid passing untrusted input into StringSubstitutor with default lookups enabled.
Where is the authoritative record for CVE-2022-42889?
The National Vulnerability Database (NVD) publishes the authoritative record for CVE-2022-42889 at https://nvd.nist.gov/vuln/detail/CVE-2022-42889, including the current CVSS score, CWE mapping, and affected-configuration data.
Related CVEs
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find known-vulnerable services before an attacker does
TurboPentest fingerprints every open port and web service, then matches detected versions against known CVEs automatically, from $99 per target.
Start a pentest