STRLCPY/CVE-2022-42889-PoC

Merge remote-tracking branch 'origin/main'
Sean Wright committed 2 years ago

ce90c254

2 parents
9b6e93b5
ff2ec816

Total 1 files

■ ■ ■ ■ ■ ■ ■

README.md

1		-	# CVE-2022-42889-PoC
2		-	Proof of Concept for CVE-2022-42889
	1	+	# CVE-2022-42889 PoC
	2	+
	3	+	This is Proof of Concept for the vulnerability [CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889). This code will run the JavaScript code `195 + 324`. If vulnerable the output should be:
	4	+
	5	+	```
	6	+	Output: 519
	7	+	```
	8	+
	9	+	In order to run this you will need:
	10	+	* JDK 11 or above
	11	+	* Maven
	12	+
	13	+	# What's the Issue?
	14	+
	15	+	The issue stems from the fact that the following keys should not be interpolated by default (as per the documentation [https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/lookup/StringLookupFactory.html](https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/lookup/StringLookupFactory.html)):
	16	+	* `script`
	17	+	* `dns`
	18	+	* `url`
	19	+
	20	+	However due to a flaw in the logic, these 3 keys are interpolated by default, when they should not (since they could represent a security risk).
	21	+
	22	+	# What's the Risk?
	23	+
	24	+	An attacker with control over the string passed into an affected `StringSubstitutor` replace could allow the attacker to:
	25	+	* Run JavaScript code on the system (typically a server) executing the `StringSubstitutor` code
	26	+	* Connect to other servers from the affected system
	27	+	* Potentially gain access to other remove resources from the affected system
	28	+
	29	+	# Am I Vulnerable?
	30	+
	31	+	In order for your code to be vulnerable you need to:
	32	+	* Be running a version of Apache `commons-text` from version `1.5.0` up to (and not including) `1.10.0`
	33	+	* Using Interpolation for your StringSubstituion (see [https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/StringSubstitutor.html](https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/StringSubstitutor.html))
	34	+
	35	+	# Official Fix
	36	+	The fix for this is to update your instances of `commons-text` to versions `1.10.0` or later.
	37	+
	38	+	# Note
	39	+
	40	+	The other default lookups could still potentially represent a security risk (such as the ability to read content of files, read system properies, etc). Use this feature with caution and make sure that all user input appropriately sanitised (for example passing through an allow list).
3	41

Merge remote-tracking branch 'origin/main'