Exploitation Summary
EIP tracks 5 public exploits for CVE-2022-33980. PoCs published by tangxiaofeng7, HKirito, sammwyy.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2022-33980, demonstrating RCE in Apache Commons Configuration via script interpolation. The exploit leverages the `ConfigurationInterpolator` to execute arbitrary JavaScript code, triggering command execution.
Description
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
Exploits (5)
This repository contains a functional PoC for CVE-2022-33980, demonstrating RCE in Apache Commons Configuration via script interpolation. The exploit leverages the `ConfigurationInterpolator` to execute arbitrary JavaScript code, triggering command execution.
This repository contains a functional exploit PoC for CVE-2022-33980, demonstrating RCE via Apache Commons Configuration's interpolation features. The code leverages script, URL, and DNS lookups to execute arbitrary commands, such as launching the macOS Calculator app.
This repository contains a functional PoC for CVE-2022-33980, demonstrating a script interpolation vulnerability in Apache Commons Configuration that allows arbitrary code execution via crafted input strings. The Java code includes a loop to accept user input and process it using the vulnerable interpolator.
This repository contains a functional Python exploit for CVE-2022-42889 (Apache Commons Text RCE). The script generates a reverse shell payload using msfvenom, delivers it via a crafted HTTP request leveraging the vulnerable string interpolation feature, and executes it on the target system.
This repository contains a functional PoC for CVE-2022-33980, demonstrating a remote code execution vulnerability in Apache Commons Configuration via unsafe interpolation. The exploit leverages a Spring Boot application to expose an endpoint that triggers the vulnerability.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H