galoget/CVE-2022-42889-Text4Shell-Docker

GitHubRepository PoC

PoC files

9 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2022-42889Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized proof-of-concept environment for CVE-2022-42889 (Text4Shell). It builds a Spring Boot application with a vulnerable Apache Commons Text 1.8 dependency and runs it in an OpenJDK 8 JRE Alpine container.

README.md:1-2Dockerfile:1-17pom.xml:1-46

Lab assessment

Vulnerability lab

The README explicitly states it is a 'Dockerized PoC for CVE-2022-42889 Text4Shell'. The pom.xml includes a vulnerable version of Apache Commons Text (1.8), and the Dockerfile packages the application into a container, consistent with a vulnerability reproduction environment.

README.md:1-2pom.xml:30-34
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

container image definition

Defines a container based on openjdk:8-jre-alpine, installs bash, copies the built JAR from /target/text4shell-poc.jar to /app, exposes port 8080, and runs the JAR.

Dockerfile:1-17

pom.xml

build configurationdependency declaration

Maven POM for a Spring Boot application. Declares a dependency on Apache Commons Text version 1.8, which is vulnerable to CVE-2022-42889. The main class is com.galoget.text4shelldemo.DockerVulnApp.

pom.xml:1-46

create-fat-jar.sh

build and run script

Shell script that runs 'mvn clean install' to build the project, then builds a Docker image tagged 'text4shell' and runs it with port mapping 8000:8080.

create-fat-jar.sh:1-5

install-openjdk-maven.sh

host environment setup script

Shell script that downloads and installs OpenJDK 13 and Maven 3.6.3 on an Ubuntu host, setting JAVA_HOME and M2_HOME environment variables. This prepares the host to build the project.

install-openjdk-maven.sh:1-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-42889

Supported by supplied evidence

The README identifies the repository as a PoC for CVE-2022-42889. The pom.xml includes Apache Commons Text version 1.8, which is the known vulnerable version for this CVE. The application name 'text4shell' and package 'text4shelldemo' further align with the Text4Shell vulnerability.

README.md:1-2pom.xml:30-34
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Host must have Docker installed to build and run the container.create-fat-jar.sh:3-4
  • Host must have Java 8+ and Maven installed to build the project, or use the provided install script.install-openjdk-maven.sh:1-30create-fat-jar.sh:2
  • The project must be built with 'mvn clean install' before the Docker image can be built, as the Dockerfile copies the JAR from the target directory.Dockerfile:9create-fat-jar.sh:2

Evidence-described exercise path

  1. Set up the host build environment by installing OpenJDK 13 and Maven (optional, using install-openjdk-maven.sh).install-openjdk-maven.sh:1-30
  2. Build the Java project with Maven to produce the fat JAR in the target directory.create-fat-jar.sh:2
  3. Build the Docker image tagged 'text4shell' using the Dockerfile.create-fat-jar.sh:3
  4. Run the container, mapping host port 8000 to container port 8080.create-fat-jar.sh:4
  5. Exploit the vulnerability by sending a crafted request to the running application (not detailed in provided evidence, but implied by the PoC nature).README.md:1-2
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The provided evidence shows a standard Dockerized vulnerability PoC. The Dockerfile copies a local JAR, exposes a port, and runs the application. The run script maps a host port to the container. No hidden, destructive, or external communication behavior is visible. The environment is self-contained and targets only the lab's own vulnerable application.

Dockerfile:1-17create-fat-jar.sh:1-5
Review boundaries

What the analysis did not establish

  • The source code of the Java application (HelloController.java, DockerApp.java) is not included in the evidence files, so the exact vulnerable endpoint and exploit vector cannot be confirmed from the supplied text.
  • The packet does not include the built JAR or any binary analysis; behavior of the application at runtime is not inspected.
  • No Docker Compose file is present; the environment is defined only by a standalone Dockerfile and shell scripts.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1