Colin Mc Hugo

0 %
Colin Mc Hugo
Security Engineer Manager & CEO at Quantum Infinite Solutions Group Ltd.

Hackers Started Exploiting Critical “Text4Shell” Apache Commons Text Vulnerability

October 21, 2022
Apache Commons Text Vulnerability

WordPress safety business Wordfence on Thursday claimed it began discovering exploitation efforts targeting the freshly revealed imperfection in Apache Commons Text on October 18, 2022.

The susceptability, tracked as CVE-2022-42889 also known as Text4Shell, has actually been designated an extent position of 9.8 out of a feasible 10.0 on the CVSS range and also influences variations 1.5 via 1.9 of the collection.

It’s additionally comparable to the currently notorious Log4Shell susceptability because the issue is rooted in the fashion string substitutions accomplished throughout DNS, script, and URL lookups can result in the implementation of approximate code on at risk systems when passing untrusted input.


A successful exploitation of the flaw can allow a risk star to open up a reverse covering link with the at risk application merely through a specifically crafted haul, properly unlocking for follow-on strikes.

While the issue was initially reported in very early March 2022, the Apache Software Application Structure (ASF) launched an updated version of the software application (1.10.0) on September 24, complied with by issuing an advisory just recently on October 13.

” Luckily, not all individuals of this collection would certainly be impacted by this susceptability– unlike Log4J in the Log4Shell susceptability, which was at risk also in its the majority of fundamental use-cases,” Checkmarx scientist Yaniv Nizry said.

” Apache Commons Text have to be utilized in a specific method to subject the assault surface area and also make the susceptability exploitable.”

Wordfence additionally repeated that the possibility of effective exploitation is substantially restricted in range when contrasted to Log4j, with a lot of the hauls observed thus far developed to check for at risk setups.

” An effective effort would certainly lead to the target website making a DNS question to the attacker-controlled audience domain name,” Wordfence scientist Ram Gall said, including demands with manuscript and also link prefixes have actually been relatively lower in quantity.


If anything, the growth is yet an additional sign of the prospective safety threats presented by third-party open resource reliances, requiring that companies regularly analyze their assault surface area and also established proper spot monitoring methods.

Customers that have straight reliances on Apache Commons Text are recommended to update to the dealt with variation to minimize prospective hazards. According to Maven Repository, as several as 2,593 tasks make use of the Apache Commons Text collection.

The Apache Commons Text imperfection additionally complies with an additional important safety weak point that was revealed in Apache Commons Setup in July 2022 (CVE-2022-33980, CVSS rating: 9.8), which can result in approximate code implementation via the variable interpolation performance.

Posted in SecurityTags:
Write a comment