Apache Commons Text RCE
Description
This exploit takes advantage of the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the “script”, “dns” and “url” lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups primarily using the "script" key. In order to exploit the vulnerabilities, the following requirements must be met: Run a version of Apache Commons Text from version 1.5 to 1.9 Use the StringSubstitutor interpolator Target should run JDK < 15
Author(s)
- Alvaro Muñoz
- Karthik UJ
- Gaurav Jain
Platform
Java,Linux,Unix,Windows
Development
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/apache_commons_text4shell
msf exploit(apache_commons_text4shell) > show targets
...targets...
msf exploit(apache_commons_text4shell) > set TARGET < target-id >
msf exploit(apache_commons_text4shell) > show options
...show and set options...
msf exploit(apache_commons_text4shell) > exploit
- Collect and share all the information you need to conduct a successful and efficient penetration test
- Simulate complex attacks against your systems and users
- Test your defenses to make sure they’re ready
- Automate Every Step of Your Penetration Test
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security