Saturday, June 22, 2024

Apache Commons “Text4Shell” Flaw Could Trigger Code Execution With Malicious Input

Many people are concerned about an RCE flaw in the Apache Commons Text library. They believe that this RCE flaw may turn out to be the next successive “Log4shell” flaw.

The new RCE flaw in Apache Commons Text is tracked as CVE-2022-42889 and the flaw has been dubbed “Text4Shell.” The GitHub security analyst Alvaro Munoz was the one who discovered the issue. A report was already sent by him to Apache on March 9, 2022, informing them of the issue.

There are many open-source Java libraries out there, but Apache Commons Text is one of the most popular, as this library comes with an interpolation system. 

Based on an inputted string lookup as a basis for the interpolation system, the developers have the possibility of performing the following tasks with the values of strings:-

  • Ability to modify
  • Ability to decode
  • Ability to escape

Technical Analysis

The flaw exists due to the interpolation system, as it executes hazardous script evaluation, which causes the appearance of Text4Shell vulnerability.

Using the library’s default configuration, it is possible for this system to trigger code execution in the event of malicious input being processed.

As a result of variable interpolation, Apache Commons Text is capable of dynamic evaluations and expansions of properties. As far as interpolation is concerned, the standard format is as follows:-

  • ${prefix:name}

Here to locate the instance of “org.apache.commons.text.lookup.StringLookup” the “prefix” is used and with the help of the located instance the interpolation process is performed.

On October 12, 2022, the open-source library developers published a bug-fixing version 1.10.0 for their open-source library, which removes the interpolation feature, a fix that took 7 months to complete.

Disclosure Timeline

  • 2022-03-09: Issue reported to [email protected]
  • 2022-03-25: Apache Commons security team acknowledged receiving the report
  • 2022-05-27: GHSL requested a status update
  • 2022-05-27: Apache Commons security team notifies they are working on disabling the script interpolation by default
  • 2022-06-29: Apache Commons security team states that “Commons Text” will be updated, in order to make the programmer’s intention completely explicit on using a “dangerous” feature
  • 2022-08-11: GHSL requested a status update
  • 2022-10-12: Apache Commons Text releases version 1.10.0 where script interpolation is disabled by default

Do you need to be concerned?

Like the damage done by the Log4Shell vulnerability, in the beginning, many users were concerned about the damage that could be done by the distribution of the vulnerable library due to its widespread deployment.

There is no indication that all versions between 1.5 and 1.9 are vulnerable. Depending on the JDK version that is being used, the exploitation potential is primarily affected.

There is a flaw in the string interpolation algorithm, which is a documented feature, but the scope of the flaw is not as serious as in Log4Shell.


The developers have recently updated the Apache Commons Text library to fix this flaw. So, they have strongly recommended users who use the Apache Commons Text library upgrade their old version to 1.10 or higher to remain safe.

Moreover, there has also been confirmation from Apache’s security team that the issue does not bear any similarity to Log4Shell, in short, it’s now so critical or serious as Log4Shell vulnerability.

Also Read: Download Secure Web Filtering – Free E-book


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles