CVE-2022-42889 (High) detected in commons-text-1.9.jar - autoclosed

[mend-bolt-for-github[bot]]

CVE-2022-42889 - High Severity Vulnerability

Vulnerable Library - commons-text-1.9.jar

Apache Commons Text is a library focused on algorithms working on strings.

Library home page: https://commons.apache.org/proper/commons-text

Path to dependency file: /hapi-fhir-validation-resources-dstu3/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar,/home/wss-scanner/.m2/repository/org/apache/commons/commons-text/1.9/commons-text-1.9.jar

Dependency Hierarchy: - :x: **commons-text-1.9.jar** (Vulnerable Library)

Found in HEAD commit: b59f2d05a7d0fd10c7b03bb6f0ebf97757172a71

Found in base branch: master

Vulnerability Details

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Publish Date: Oct 13, 2022 1:15:00 PM

URL: CVE-2022-42889

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.openwall.com/lists/oss-security/2022/10/13/4

Release Date: Oct 13, 2022 1:15:00 PM

Fix Resolution: 1.10.0

---

Step up your Open Source Security Game with Mend here

[lari-kannisto]

As the CVSS Base Score is now 9.8 I would update the Severity to Critical. Please patch as soon as possible!

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[dmitchellmim]

Was it determined that HAPI FHIR is not affected by the vulnerability?

[ThomasVitale]

The string substitution feature of the library (StringLookupand StringSubstitutor), the one affected by the vulnerability, is used in a few places. For example: https://github.com/hapifhir/hapi-fhir/blob/master/hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/LoggingInterceptor.java#L155 Considering that the data parsed comes from an HTTP request, could that be exploited to inject the vulnerable url, dnsor scriptprefixes? Or is it safe because it's not using the interpolation strategy?

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[Romanow88]

@ThomasVitale the main affected part is the StringLookup. The lookup that is used for the LoggingInterceptor is the MyLookup, which does not process the prefixes.

[ThomasVitale]

@Romanow88 thank you for clarifying that

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[KatherinePapcun]

I think this is a duplicate of #4168 (which is currently open). Open merge request here: #4159

[ohtu123]

Any ideas, when do we get a release of hapi-fhir-base that contains this fix?

[LemmingAvalanche]

It looks like this was closed because it was determined that the vulnerability is not relevant. In any case the pom.xml now has a non-affected version:

<commons_text_version>1.10.0</commons_text_version>