WordPress security company Wordfence on Thursday said it started detecting exploitation attempts targeting the newly disclosed flaw in Apache Commons Text on October 18, 2022.
The vulnerability, tracked as CVE-2022-42889 aka Text4Shell, has been assigned a severity ranking of 9.8 out of a possible 10.0 on the CVSS scale and affects versions 1.5 through 1.9 of the library.
It's also similar to the now infamous Log4Shell vulnerability in that the issue is rooted in the manner string substitutions carried out during DNS, script, and URL lookups could lead to the execution of arbitrary code on susceptible systems when passing untrusted input.
"The attacker can send a crafted payload remotely using 'script,' 'dns,' and 'url' lookups to achieve arbitrary remote code execution," the Zscaler ThreatLabZ team explained.
A successful exploitation of the flaw can enable a threat actor to open a reverse shell connection with the vulnerable application simply via a specially crafted payload, effectively opening the door for follow-on attacks.
While the issue was originally reported in early March 2022, the Apache Software Foundation (ASF) released an updated version of the software (1.10.0) on September 24, followed by issuing an advisory only last week on October 13.
"Fortunately, not all users of this library would be affected by this vulnerability – unlike Log4j in the Log4Shell vulnerability, which, which was vulnerable even in its most basic use-cases," Checkmarx researcher Yaniv Nizry said.
"Apache Commons Text must be used in a certain way to expose the attack surface and make the vulnerability exploitable."
Wordfence also reiterated that the likelihood of successful exploitation is significantly limited in scope when compared to Log4j, with most of the payloads observed so far designed to scan for vulnerable installations.
"A successful attempt would result in the victim site making a DNS query to the attacker-controlled listener domain," Wordfence researcher Ram Gall said, adding requests with script and URL prefixes have been comparatively lower in volume.
If anything, the development is yet another indication of the potential security risks posed by third-party open source dependencies, necessitating that organizations routinely assess their attack surface and set up appropriate patch management strategies.
Users who have direct dependencies on Apache Commons Text are recommended to upgrade to the fixed version to mitigate potential threats. According to Maven Repository, as many as 2,593 projects use the library, although Flashpoint noted that very few of those listed use the vulnerable method.
The Apache Commons Text flaw also follows another critical security weakness that was disclosed in Apache Commons Configuration in July 2022 (CVE-2022-33980, CVSS score: 9.8), which could result in arbitrary code execution through the variable interpolation functionality.
