Apache Commons - Remote Code Execution (CVE-2022-42889)

Apache Commons library is affected by a Remote Code Execution vulnerability. The root cause of this vulnerability is the StringSubstitutor interpolator object. If a remote unauthenticated attacker can pass the "${script:payload}" string to the StringSubstitutor via an exposed enpoint, then RCE can be achieved.

Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.

The risk exists that a remote unauthenticated attacker can fully compromise the target in order to steal confidential information, install ransomware or pivot to the internal network.

Upgrade Apache Commons to the latest version or to a version higher or equal to 1.10.

https://nvd.nist.gov/vuln/detail/CVE-2022-42889

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889